One of the things I remember being discussed on m.d.s.policy not so long ago was making a registry (maybe handled by IANA) for example private keys. Turns out Peter Gutmann did the heavy lifting (thank you Peter) to turn that from idle discussion into a draft document:

https://datatracker.ietf.org/doc/draft-gutmann-testkeys/

From the point of view of m.d.s.policy the main idea is to require CAs to reject these keys in certificates for the Web PKI and encourage software to use these keys (rather than their own examples) in sample code. Basically when you build my-cool-website.example and copy paste the private key from an example into your certificate fetching code, the CA should say "Er, no, you need to actually choose your own private key, that's what the word private means" and this should happen when you copy-paste a high-rated Stack Overflow example, the provided sample code from the library you used etc. Ideally these would all be the same keys is the idea.

It would also make sense for tools to care about these example keys e.g. GitHub could flag code that's checked in and has keys which are not these examples since maybe you used real keys by mistake in your GitHub repo, meanwhile your build-for-production CI tools could reject keys which are on the list because that means you forgot to pick actual keys for the real build.