Turns out we already have this in OpenACS 5.2. I went to upgrade my keys from the catalog files and got a "merge notice" asking me if I wanted to keep or reject the locally modified keys.
Checked with super-hero Joel and he verified it was part of 5.2 :)
