So when a site is hacked, the hackers replace the email and public key in this file with their own (or one that goes to /dev/null), and the site's owners are never informed when someone else notices the breach and tries to use this file as intended.
There should either be a well known convention (like security@ as others hadn't mentioned), or an external public registry of this sort of thing)
Because it's a standardized text file in a standard location, it's quite easy to add a black box monitor of the file and alert if the values change. If anything, mucking around with the file is the last thing hackers want to do, because it would tip off the operators that there had been a breach, that the operators otherwise would not have noticed.
There should either be a well known convention (like security@ as others hadn't mentioned), or an external public registry of this sort of thing)