True they can also get information from the public ssh key like if you used a real email address or name to start spear phishing or who knows what else like extortion threats to your company