The command --revoke-additional-key removes the additional key.
--revoke-additional-key
Command syntax
kesl-control [-L] --revoke-additional-key