I am inclined to instead have a --clear-keys instead. In retrospective, lots of people broke their end devices with ttnv2 by not knowing that outside of dry runs, the keys are cleared.

Making it safe by default seems a good idea to me. --clear-keys seems to be related to the implementation, maybe something describing what's happening from a higher point of view like --disable-devices (probably some better options out there) could work as a universal solution in the future? Unless that's not the intent.

Disable implies that it can be rolled back, which is not really the case when you delete the keys and forget to save the output (this happened many times). At least --clear-keys is equivalent to --i-really-know-what-i-am-doing.