Granting credits only when both keys can be written, and still creating the account, is the right call. Blocking the signup outright just makes support emails. Good flag on hard deletes freeing up the keys too, that's easy to miss until someone starts farming it.