I fully agree with you. 

I'm just was wondering *why* is the legacy key creation is needed. - If this app is enabled, the new key creation should be used instead of the old – insecure – one.