To use a fearful, apt analogy: resolving the operational issue isn't just plugging the hole in the dam, its also fixing the damage by pumping the water out and then addressing the damages.
In your analogy they can't pump the water out. Now it's up to their users to rotate their keys. How do you expect them to do that sort of thing on behalf of their users?
Depends on the TOS, but, blocking service until confirmed or decommed would get the trick done.
That doesn't even make sense. People use environment variables to store things like API keys for third-party services. How do you expect them to magically rotate or decommission those keys?
Trigger.dev wouldn't rotate customer BYOK. What I was saying is they disable customer use of their service until rotation occurs or is confirmed by the customer.
That doesn't really help anything and just makes the exploit impact even worse since it would be effectively a denial of service