That's why I didn't say "fix" but "address". It doesn't "unleak" the key of course, but makes it possible to unlink the compromised npub from your name (update the DNS record) and inform followers of the new npub