Merge keys when updating an exisiting key

This is needed to prevent roll back attacks where the attacker push us
to accept a key with an old expiration date that could be use to push an
untrusted key when after it's expiration.
Remove outdated comment
Use datetime for key expiration