There are some implementation details in my storage layers that would prevent this problem from happening, I think. The main one being that the only way to change the public key of an actor is to update the actor itself, the key does not exist as a stand alone object that could be overwritten maliciously.
There might be some corner cases, but I'll try to come up with some tests.