Attacker sends request to PoS user for old keys,
PoS user agrees to sell/send old keys to Attacker only upon receipt of payment for keys.
PoS user informs the PoS Dev of sold keys, before the attacker can launch his attack ,
PoS Dev updates checkpoint thru program update, making the attacker purchase of old keys useless.
Now the attacker has the useless keys and lost his payment , and the PoS User & Dev are Laughing at the attacker's attempt.
*What is funny is the attacker whom is attempting to do harm with a dishonest heart, thinks the PoS User will be honest with him.*

This might be the primary reason , no one ever tries to buy old keys.
Because it is so easy to turn the attacker into the Chump.Actually, it is not a mitigation by any means.
Suppose, I have a dominant share of a PoS coin. I exchange my coins with a decent PoW coin (
) and cash out, now I'm able to commit a long range attack against the network or participate in such an attack using my old private keys with zero cost.