Adobe recently published their PGP private key by accident. They have now issued a new one. But will they need to re-sign (with their new key) everything that was signed with their old key? As somebody could now sign malicious content with the old key and pretend it was published before the leak date?
It wasn’t their code-signing key that they compromised, it was the email key for their product security incident response email address. It’s embarrassing, but it doesn't affect the integrity of their code. In practice, that key is probably not used for nearly all the email that’s handled by that address, because PGP is only used by a tiny fraction of email users.