this touches two pieces of my knowledge:
- microsoft is evil, I cannot delete my github account, will never use anything by this company
- if the attacker knows your *public* key they can enumerate the list of the servers you have access to https://github.com/benjojo/ssh-key-confirmer
http://gitHub.com/fragmede.keys, for example. Stick that in authorized_keys to let me into your server.