Firefox, likely Chrome, and maybe other major browsers update certificate revocations independently of the main app. Things are more complicated with various command-line apps and daemons, programming languages and libraries, which may require updates to system-wide packages or, worse, libraries for individual programs (ahem Python).

Also, private keys aren't published, that's their defining characteristic. Public keys are published, and of course they are used to check signatures made with particular private keys — in this case the ones generated by the security researcher.