> though it smells like the opposite of responsible disclosure He's not sharing the key itself, just proof that it's been leaked. Unlike disclosing a security

> though it smells like the opposite of responsible disclosure He's not sharing the key itself, just proof that it's been leaked. Unlike disclosing a security issue without warning, this disclosure doesn't give any bad actors and power they didn't already possess. (Because any bad actors who have the key would already know what TLS certs it matches, or could trivially find out by querying CT logs themselves.)