What is indeed missing is a limited validity period of the key, as a certificate would provide. Then everybody would be clear on how long the key can be used.