Notation delete returns confusing message

[toddysm]

What is the areas you experience the issue in?

Notation CLI

What is not working as expected?

I am trying to delete a key from the keystore but after issuing the notation key delete command, I see this:

~ notation key delete $TEST_KEY_NAME
wabbit-networks.io: unmarked as default

This is quite confusing :( Did the key get deleted or just "unmarked as default"? There is no other command that I can use to "remove" the key and this is my intention - the key is expired and not needed anymore.  

What did you expect to happen?

I expect the key to be removed from the trust store and the message to be clear that the key is removed.

How can we reproduce it?

Use the command to delete the key

Describe your environment

N/A

What is the version of your Notation CLI or Notation Library?

Notation: Notary v2, A tool to sign, store, and verify artifacts.

Version: 1.0.0-rc.3
Go version: go1.20.1
Git commit: 233c0ea

[toddysm]

Digging more into this. Removing the invalid key from the machine is quite an elaborate experience. My expectation was that running the above command will "delete" the key from the trust store. That doesn't seem to be the case though because issuing notation cert generate-test --default "wabbit-networks.io" still returns:

generating RSA Key with 2048 bits
generated certificate expiring on 2023-03-30T17:30:10Z
wrote key: /Users/toddysm/Library/Application Support/notation/localkeys/wabbit-networks.io.key
wrote certificate: /Users/toddysm/Library/Application Support/notation/localkeys/wabbit-networks.io.crt
Error: certificate already exists in the Trust Store

Bearing in mind the confusing message from delete and this experience, it is not very clear what delete did.

The user really needs to pay too much attention to get this thing done. Removing the key doesn't remove the cert from the Trust Store, which may be the desired goal but would be good if we had a more user-friendly design. Asking the user if she/he wants to remove the cert would go a long way.

[toddysm]

The last in this experience. If I try to delete the cert using notation cert delete, I get the following error:

~ notation cert delete wabbit-networks.io
Error: named store name needs to follow [a-zA-Z0-9_.-]+ format

Again, the error is confusing as it seems the convention is followed. Using quotes around the name changes nothing.

[FeynmanZhou]

For notation key delete, I think it should have the option to delete the local key from the Trust Store especially when it is invalid or for testing purpose only. Meanwhile, we could refine the error message to avoid confusion when deleting a signing key.

For notation cert delete, if you want to delete the certificate from the Trust Store, try notation cert delete --type ca --store <trust_storeName> (--all | <cert_fileName>). The error message should be refined and those two tags should be considered as required options.

Let's aim to fix this issue in RC.4.