Technically, if those keys could be extracted (I'm no expert on that), that would be the easier option, as Twitter cannot really afford to revoke those without massive headaches on their end. You likely couldn't distribute those keys, but I have no idea if automatic extraction at install time would be fair game on a large scale.