"I hope they still invalidated that key and got a new one, because I don't think simply git reset and force pushing to overwrite a commit you already pushed to

"I hope they still invalidated that key and got a new one, because I don't think simply git reset and force pushing to overwrite a commit you already pushed to a public repository is sufficient to make sure someone didn't already capture it." -I totally agree you.