But then you could just have a third key to use in place of the first for anything you think you might want to get out of later. You could have a mechanism to

But then you could just have a third key to use in place of the first for anything you think you might want to get out of later. You could have a mechanism to prove two emails are signed with the same key, without revealing the public key (e.g. using a zero-knowledge technique like zk-SNARKs) - but that might then be functionally equivalent to just revealing the key in terms of non-repudiation anyway.