Came here to say the same thing.

Doesn't the CA forum baseline require a revocation if the private key is published?

https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.p... on page 18:

    The CA SHALL revoke a Certificate within 24 hours 
    if one or more of the following occurs: 
    (...)
    3. The CA obtains evidence that the Subscriber’s 
    Private Key corresponding to the Public Key in the
    Certificate suffered a Key Compromise or no longer
    complies with the requirements of Appendix A;