You don't tell them which keys you extracted. If they have to revoke every phone of that model then lots of normal users have them and vendors can't rely on people having phones that support it anymore, so good.

And the attacker doesn't care if the key gets revoked after they've stolen your money.