> A certificate revocation request signed by the private key is proof of private key compromise. There's no such thing in this case. In the blog post, I quoted

> A certificate revocation request signed by the private key is proof of private key compromise. There's no such thing in this case. In the blog post, I quoted from Apple's Certification Practice Statement: "The Subscriber may initiate a revocation request by sending an email to productsecurity@apple.com. The request for revocation will then be evaluated by Apple." Everyone wants to make an analogy between Developer ID code signing certificates and web server certificates, but the usage of the two kinds of certs is completely different.