Revocation should can only be done if the latest signed image tags are not signed by this key.

Minimum viable:

• return a HTTP error response to inform API consumer there are images signed with this key

Improvement:

• which tags are signed with this key