If GitMonkey has your key on record - it means we're not the only ones having it. You should revoke it immediately. So even if our db is breached, it should only contain a list of useless revoked keys.

No, if I want to do my job correctly I'll encourage best practices and address careless deviations. I won't encourage bad behaviour by outsourcing simple workflow tooling to a third party that doesn't have any accountability if they drop the ball.

Whether you realize it or not, you're advocating for increasing surface area and risk. You're offering a service to people with bad opsec while simultaneously asking them to trust your opsec; none of which is a good solution to the actual problem.