I have an IOS application for a client and I need to push it as an update to the existing app. I already received the credentials of the itunesconnect account which includes the application however here is my problem.  

I don't have the private key which was used to publish the initial application which according to the below could cause a problem.  

*The private key is locally stored on the Mac device (in this case, the old vendor).   

In the wrong hands, someone might attempt to distribute an app that contains malicious code. 
Not only could that cause the app to be rejected, it could also mean our developer credentials could be revoked by Apple.*  

Is there a way to retrieve the old key?

In the case where I sign the application with another certificate, will still go as an update to the existing one?