In CFE-861 cf-key gained the ability to remove keys identified by digest instead of just hostname or ip. The help output only indicates that keys can be removed by hostname or ip.
> $ cf-key -h
Usage: cf-key [OPTIONS]
--remove-keys , -r value - Remove keys for specified hostname/IP
--force-removal, -x - Force removal of keys (USE AT YOUR OWN RISK)
cf-key -r cannot remove hash strings but IP