I use kubesec to encrypt kubernetes secrets. I update the secrets using
kubesec encrypt --in-place --key=... --key... --key....
I expect kubesec to encrypt to the specified keys only. Otherwise I would use the + option.
What really happens is that kubesec does not remove the keys that are not specified.