No, they use revokedkeys. For that to happen you'd need for the revokedkeys process that happens when someone leaves to fail as well as your network security on your servers and/or client VPN.