But it's a big pain to do the deletion, especially when you have to do it one file at a time and have to put in your SSH password each time (should have gotten my SSH key uploaded to SourceForge, but I was new to SSH at the time, too). And, as you mentioned, it doesn't really delete the file, unless you can get into the guts of the CVS database (which for SourceForge, means taking out a support ticket and waiting). So my old GnuPG secret key ring is there for the world to download (though the first thing I did was revoke the keys).