Ref T10917. Currently, when you delete an SSH key, we really truly delete it forever.
This isn't very consistent with other applications, but we built this stuff a long time ago before we were as rigorous about retaining data and making it auditable.
In partiular, destroying data isn't good for auditing after security issues, since it means we can't show you logs of any changes an attacker might have made to your keys.
To prepare to improve this, stop destoying data. This will allow later changes to become transaction-oriented and show normal transaction logs.
The tricky part here is that we have a UNIQUE KEY on the public key part of the key.
Instead, I changed this to UNIQUE (key, isActive), where isActive is a nullable boolean column. This works because MySQL does not enforce "unique" if part of the key is NULL.
So you can't have two rows with ("A", 1), but you can have as many rows as you want with ("A", null). This lets us keep the "each key may only be active for one user/object" rule without requiring us to delete any data.