Adding the private key to a local keychain seems to fail but actually succeeds.

I was about to post the following issue:

> I'm trying to `keybase pgp import` my private key on a newly provisioned device. This fails with
>
> ```
> - ERROR This key is already active. You can't add it twice. (error 923)
> ```
>
> -- which is true; this key is already active, but since I'm not storing the private key on the server, this device only knows the _public_ key and thus isn't really useful. How do I give it the matching private key (without pushing it to the server)?

but then I checked one more time and realized that the private key has in fact been added to the local keychain. So the local operation was successful, it's just that there wasn't really anything to add to the account.

Start by reproducing the `keybase pgp import` flow on a device where the public key is already active but the private key is absent locally. Trace the command's handling of the duplicate active-key response and local keychain update; done means a successful local import is reported distinctly from an account-level duplicate.

Written by the indexing model from the issue text.