Speaking from personal experience: I received 7 emails from them, for various "tag" parts of my email (username+tag@server.example). Two of them - for when I was playing with Caddy server many years ago (well before COVID) - and its "auto-https" feature. There's no chance I still have these keys - I likely `rm -rf`'d whole caddy directory.
You probably would need to reauthenticate via DNS, create a new private key and then do what you wanted to do.
EDIT: this is just a guess.
In my view there’s only one thing to do when emails don’t contain an unsubscribe link: report spam — because it is, as described by CAN-SPAM.
Consider an outage email containing a diagnostic report. You might be the relevant person on call for that email and based on the diagnostic you forward it to who should be most competent to fix the issue. This person/team has now read access to the email, but they should not be able to unsubscribe you from these notifications.
In general unsubscribing should not be unduly harder than it needs to be.
For marketing email the effort required should be zero; for critical security issues (like certificates) it should be more.
So, here's the problem, I don't care. I left the company. I cannot access the account anymore. The project is dead. There are a million reasons why I just don't want your emails so there's no excuse to not add an unsubscribe link.
The only messages that don't have to include such link are those that if missed/ignored lead to fees, fines, death, imprisonment and other real-life consequences.
An update to your privacy policy does not fall into that category.
My point was not that you should keep receiving those emails, it was an example of the necessity of having sometimes other mechanisms.
An unsubscribe email address could work better (assuming that if you can send arbitrary emails from an address then you control it).