For more than 20 minutes after deletion, some Google API keys can still be used, apparently creating a major security gap.