Yea but you've breached NDA and likely committed some kind of intentional sabotage because this was done 4 times, so what happens to you is up to the courts and how you can argue it.
If this guy was going for intentional sabotage, why not sell the keys on the dark web? Why not anonymously publish them on pastebin?
Why would he just upload them to github under his own name?
Like it's easy to make the same mistake if you weren't alerted to it the first time.