Comment 9 for bug 1481871

David, the CVE would be strictly for reporting "OK" to a delete command that did not actually delete anything.

When an admin tries to remove a trusted key, the tools should either report success when it does, or failure when it cannot.

I'm worried about the "apt-key adv --recv-key" issue; that's certainly not mentioned in the manpages the last few times I've used this. We should remove this advice from the manpage or provide a warning that it is not safe to use this, despite previous recommendations.

Thanks