check for credential-less characters

Ideally this will be rolled into key deletion.