log "unspecified" flags differently
add test case for duplicate keys in keyring (#870)
reject keys with duplicate subkeys altogether

closes #870