@mariusor The key can also be embedded within another object like a Note and be identified by a fragment ID.
I ended up scanning all submitted activities and their embedded objects for anything that has publicKeyPem or publicKeyMultibase properties. If a key is found, the activity is rejected.