Also, credit card numbers do expire. You could just make a backup copy of somebody's private key and wait a year or two before transferring all their funds to your account, unless they move the money away to a different address themselves.

It's an interesting point. That said, forensics on VPS's / cloud providers is already a big thing. Until now it's mostly been databases, secrets, SSH keys etc. Well-known providers zero their storage... lesser known, not so much.

> Credit card thefts can be reversed.

Yeah, that's the only reason hosting companies don't mass harvest credit card numbers from their customer's websites