def shadowCredentials(conn, target: str, key: str = None):
    """
    Remove Key Credentials from target

    :param target: sAMAccountName, DN, GUID or SID of the target
    :param key: RSA key of Key Credentials to remove from the target, removes all if key not specified
    """
    keyCreds = next(
        conn.ldap.bloodysearch(target, attr=["msDS-KeyCredentialLink"], raw=True)
    )["msDS-KeyCredentialLink"]
    newKeyCreds = []
    isFound = False
    for keyCred in keyCreds:
        key_raw = common.DNBinary(keyCred).value
        key_blob = cryptography.KEYCREDENTIALLINK_BLOB(key_raw)
        if key and key_blob.getKeyID() != binascii.unhexlify(key):
            newKeyCreds.append(keyCred.decode())
        else:
            isFound = True
            LOG.debug("[*] Key to delete found")

    if not isFound:
        LOG.warning("[!] No key found")
    conn.ldap.bloodymodify(
        target, {"msDS-KeyCredentialLink": [(Change.REPLACE.value, newKeyCreds)]}
    )

    str_key = key if key else "All keys"
    LOG.info(f"[-] {str_key} removed")

    Remove Key Credentials from target

    :param target: sAMAccountName, DN, GUID or SID of the target
    :param key: RSA key of Key Credentials to remove from the target, removes all if key not specified
    
bloodyAD/cli_modules/remove.py