Revoking the keys makes whatever existing artifacts and packages signed with old keys fail integrity checks. Revoking the published packages and rotating compr

Revoking the keys makes whatever existing artifacts and packages signed with old keys fail integrity checks. Revoking the published packages and rotating compromised passwords should certainly also be done, but neither of those stop packages in mirrored or present in local caches from being used without further intervention (assuming your packaging ecosystem regularly verifies packages have valid signatures, which sadly I know ecosystems like NPM do not).