So, if the old key is public, we can't use DKIM to verify any leaked emails that were acquired after the publication date?

Sounds suspiciously like somebody's thinking ahead on how to plausibly deny some yet-to-be-leaked emails.