We don't have the specific need for doing it manually. The ideal solution is of course preventing access automatically by system just like what you said; our suggestion about manually revoking keys is just "eh, if we can't do it automatically then manual is fine" kinda thing, since by making claims mandatory each key is already bound to a specific user 😉