git filter-branch --index-filter 'git rm --cached --ignore-unmatch rsa_private_key' -- --all Now you have a completely rewritten repository. Anyone who cloned

git filter-branch --index-filter 'git rm --cached --ignore-unmatch rsa_private_key' -- --all Now you have a completely rewritten repository. Anyone who cloned or forked your repo will have the old history, divergent with your own, still containing the sensitive key. It's quite a mess to clean up, but that's about all you can do.