> Keybase can't know who the person logged into the account is either. But they can tweet, and so keybase will tell everyone that the twitter account which has signed tweets using my private keep is tweeting.

This is true. In the scenario where the account is compromised you are supposed to revoke the signature.