Yes, he can. But his checkpoints will cause conflict, all clients will switch into safe mode and "Invalid checkpoint found!" or "Invalid chain found!" warning message will be displayed. Stolen key becomes useless immediately after this and checkpoints chain reset would be required to resolve this situation. That's why he must DDoS existing node before, to prevent it from sending checkpoints.