Firefox, likely Chrome, and maybe other major browsers update certificate revocations independently of the main app.

Also, private keys aren’t published, that’s their defining characteristic. Public keys are published, and of course they are used to check signatures made with particular private keys — in this case the ones generated by the security researcher.