Impersonating the server allows code theft. > Could anyone with that key have cloned any GitHub repo, private or not? If you try to push to GitHub but someone

Impersonating the server allows code theft. > Could anyone with that key have cloned any GitHub repo, private or not? If you try to push to GitHub but someone is MITMing you with the leaked key, they can say "I'm an empty repo" and the client will helpfully push all the commits to the attacker. Until everyone updates their .ssh/known_hosts file, a MITM attack can still steal code in this way.