If that account had id_rsa in it then I'd send them a courtesy email, since that is a private key, but otherwise publishing your public keys is not worrisome.

If that account had id_rsa in it then I'd send them a courtesy email, since that is a private key, but otherwise publishing your public keys is not worrisome. Consider the threat environment: I have a laptop with a private/public key pair that gets me my main login on all services I run. It is possible that Server #1 can get compromised, immediately compromising the public key on it. I do not desire Server #2 to get compromised. No problem -- with only the public key, they can't compute my private key. Also, when I authenticate with them, I don't have to divulge my private key -- we can play a little game over the wire and my system provides an answer which would have been computationally unfeasible to calculate without having my private key handy. There might be some minor data leakage if you name your keys something descriptive. Mine are typically no more sensitive than email addresses.