Compromised pubkeys should be revoked I'm not sure for the eternal destroyer bot. Maybe the relays can "automagically" destroy objects by themself when it's signed using a key flagged revoked...
Does the deletion is delegated to the relay? I mean the relay should distribute deletion event instead of publication or other events on the content. I'm not really into the protocol, maybe the relay can't do any active initiative but must be triggered by user ?