do we act on revoked keys?
To check if a key can upgrade another key we check if the key is expired, but do we check if it's revoked? There is no update mechanism yet, but as soon as there is one we should check for the revokation as well.
(from redmine: created on 2016-06-24, relates #6089 (closed))