1Stop using it
Assume someone else now has the key, even if you deleted the message quickly.
2Revoke it
Import your revocation certificate, or generate one, and publish the revoked key where your old key was shared.
3Create a new key
Generate a fresh key pair and update it everywhere the old one was used, including two-factor settings.
4Tell your contacts
Let people who use your public key know about the change, signing the notice with the new key.
Lesson summary
A leaked private key must be revoked and replaced, never kept in use.
Looking for the current address? See the WeTheNorth link status.