I changed my method name "api_keys" to "admin_api_keys"
Is it enough or would you like something more complex directly into the user controller ?
For this second option, I think I would not have enough time to do it.
Tested seems secure and functional to me, I think this should be merged. Styling of the user API key table probably should be brought in line with the rest of Galaxy, but this is a small point.
There are a lot of imports that aren't used. Could you clean these up?