Bizarre that nowhere does this article say you must invalidate the key. Lots of people could well have pulled a branch with the key, and rewriting history will make this very obvious.
"As stated above, the history features of version control systems mean that simply removing the tokens and then committing the result is not enough. If you can, you might want to consider revoking the keys that have been made public, so that anybody who may have discovered them already will be prevented from using them."
"If you can, you might want to consider revoking the keys that have been made public, so that anybody who may have discovered them already will be prevented from using them."
Thats a very weak statement. It is the first thing you should do.