They've probably rotated the keys since they were notified of the security breach.

But yes, companies that act this way undermine the resolve to disclose their security vulnerabilities.

Ssh keys to what? If the key is used for user operations, not internal then there's no security breach here other than deobfuscation.

Sounds like that’s one of the few things it refuses to do. I suppose it may be possible with a little more priming though.

Yes