See one of my previous posts and what should also be done
Keys dont matter anything if you have given access to posting to any app
it will still continue to work as posting auth (not the keys but the access token), unless you revoke access
https://steemit.com/hive-185836/@xpilar/who-has-access-to-your-account-has-it-been-hacked
Thank you sir. I added it to this article. Really useful for all the users !