Yes, I would be unable to do my job, and I would have to consider the project security higher than features then. If I knew a project had been compromised, the

Yes, I would be unable to do my job, and I would have to consider the project security higher than features then. If I knew a project had been compromised, the next step should always be to move away from it or fix the issue. The solution would maybe not be to delete all the code, but just not accept any updates since it is not sure the key belongs to the rightful owner.