If the operator key is compromised
The whole verification scheme rests on one private key staying private. It is worth thinking about what happens if it does not, before rather than during.
What compromise would mean
Somebody other than the operator could sign announcements that verify perfectly against the key you hold. Verification would keep saying good signature, because the signature would be good. The mathematics has no opinion about who is holding the key.
How it would surface
- A revocation certificate published and signed with the key itself, which is the clean case.
- Contradictory announcements signed with the same key, which is the messy case.
- A new key announced without a signature from the old one, which is the ambiguous case and the one to be most careful with.
Why a revocation is signed with the key being revoked
Because only the holder can produce it, which is what makes it credible. A revocation announced any other way is a claim rather than a proof, and claims are what an attacker would also make.
What a reader can conclude
Less than they would like. From outside, a compromised key and a healthy one are indistinguishable until something inconsistent appears. This is a genuine limit of the scheme rather than an implementation flaw, and pretending otherwise would be dishonest.
What still helps
Continuity. A key that has signed every announcement for years, holding a fingerprint you recorded independently before today, is far better evidence than a key introduced this week. It is not proof and it is the best available.
The behaviour that survives all of this
Keeping a saved address list and not going hunting during an outage. That habit does not depend on any key remaining secure, which is why it remains the single most useful thing on this site.
What to do the day it is unclear
Stop using addresses from announcements and fall back to whatever you already held and have used successfully. Ambiguity is not a reason to accept new strings from unfamiliar places, it is a reason to accept none at all until the situation resolves. Waiting has never cost anybody an account.