The nomad operator root keyring remove command hits an RPC that checks if the key is currently active, but doesn't prevent the key from being removed if it's inactive but used to encrypt an existing Variable (or sign an existing Allocation). The GC job uses the same RPC, but has already checked that the key is not in use via the IsRootKeyInUse state store method.

We should have the Keyring.Delete RPC check the same method and return an error if the key is in use, unless a Force flag is set in the request. The GC job will always set that flag. Update the CLI to first send the request without Force and then ask the user to confirm their intent.