Function redact_keys 

pub fn redact_keys(source: &str, keys: &[String]) -> String

Remove every one of keys from captured source text — for an embedder storing source alongside plans, so the stored text never carries a credential. The whole --confirm=<key> token goes, not just its value, so re-running the stored text cannot re-present a spent key.