api: record user action in the RemoveKeyFromUser handler

Related to #397.