fix: only delete API keys if the primary key was found

While trying to fix !2, I kept getting my active API key deleted because the "active key" never matched any keys (until I realized I needed the -n flag to strip the newline). And I'd need to create a new key to keep testing.

Instead, this PR makes sure keys are only deleted if a "primary key" was found.