You're totally right. I guess there is no need to manually delete it, just let the GC do it. The encryption key is stored in the ChefAPI object anyway, so there is not much sense in that. Thanks for pointing this out.