Hacker News Reader

The other possibility is that someone creates a malicious service that harvests and tries connecting using those keys. Scary indeed.

People leave private keys in repos all the time. I'm pretty sure this talk goes over it pretty well. https://www.youtube.com/watch?v=AwUJ9vpR7Vg