Yep, but most people will find out their key has leaked after the attacked already created all their events. It would be impossible to distinguish unless the user goes through one by one to check.
Also, now clients need to do even more in checking each event id if it is part of the signed filter or not.
There would forsure be a period during recovery where the attacker could do damage. I was imagining that it’s “solved” by user with posts after the fact. But that may not be good enough vs what an attacker could do in a short period of time
On the second part, acknowledging this is more expensive for clients and relays which is why i suggested insurance premium payments so they are covered (and hopefully net winners if priced correctly) for when they need to handle this situation
