Site affected by PSA-2014-003, revoke all public keys? I didn't patch my website right after PSA-2014-003, it run about one week unpatched. 

Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase protected authentication key to login to the server over ssh. The website in question doesn't use SSL (https).

In the chart on http://drupal.geek.nz/blog/your-drupal-website-has-backdoor, is says: "Revoke public keys for any of the server's private keys." I don't really understand what does it means. Does it refers to certificate-authenticated SSL (https://) or does it refers to the authentication keys used to login to the server over ssh? Do I have to generate a new pair of authentication keys for my new server?

Thanks!
Short answer

You don't need to replace your SSH-keys if only their public part was stored on the server. And that's usually the case if you've only used it for logging into the server.

Long answer

Since the server may have been compromised all the data on the server might have been copied by any number of attackers. This includes everything used for authentication:


private keys (SSH, SSL, GPG, …)
passwords, if they were stored in an insecure manner
API-keys for other web-services
The mysql password


You should replace all of them.

For SSH's public-key authentication you usually copy your public key into the ~/.ssh/authorized_keys file. Your private key remains safely on your computer. Therefore there is no need to replace your ssh-keys. That's the main benefit of asymmetric encryption: Everyone can have your public key without compromising the security.