Remove extra pgp_key fields.

third_party/terraform/resources/resource_google_service_account_key.go

@@ -76,10 +76,12 @@ func resourceGoogleServiceAccountKey() *schema.Resource {
 			"private_key_encrypted": {
 				Type:     schema.TypeString,
 				Computed: true,
+				Removed:  "The private_key_encrypted field has been removed. See https://www.terraform.io/docs/extend/best-practices/sensitive-state.html for more information.",
 			},
 			"private_key_fingerprint": {
 				Type:     schema.TypeString,
 				Computed: true,
+				Removed:  "The private_key_fingerprint field has been removed. See https://www.terraform.io/docs/extend/best-practices/sensitive-state.html for more information.",
 			},
 		},
 	}

third_party/terraform/website/docs/r/google_service_account_key.html.markdown

@@ -88,15 +88,7 @@ The following attributes are exported in addition to the arguments listed above:
 * `public_key` - The public key, base64 encoded
 
 * `private_key` - The private key in JSON format, base64 encoded. This is what you normally get as a file when creating
-service account keys through the CLI or web console. This is only populated when creating a new key, and when no
-`pgp_key` is provided.
-
-* `private_key_encrypted` – The private key material, base 64 encoded and
-encrypted with the given `pgp_key`. This is only populated when creating a new
-key and `pgp_key` is supplied
-
-* `private_key_fingerprint` - The MD5 public key fingerprint for the encrypted
-private key. This is only populated when creating a new key and `pgp_key` is supplied
+service account keys through the CLI or web console. This is only populated when creating a new key.
 
 * `valid_after` - The key can be used after this timestamp. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".