zabbix-repo: disable zabbix key when switching repos

zabbix-repo/tasks/main.yml

 ---
 # this essentially does what zabbix-release does, but does not mitigate package signing
 
-# TODO place file
-# see: https://repo.zabbix.com/zabbix-official-repo.key
 - name: ensure apt got the key to verify the zabbix repo
   apt_key: data="{{lookup('file', 'zabbix.gpg')}}" state=present
+  when: debian_version == "jessie"
+  notify:
+    - update apt cache
+  tags:
+    - packages
+    - repos
+    - zabbix
+
+- name: ensure apt got the key to verify the zabbix repo
+  apt_key: data="{{lookup('file', 'zabbix.gpg')}}" state=absent
+  when: debian_version == "stretch"
   notify:
     - update apt cache
   tags:
@@ -37,10 +46,10 @@
     - repos
     - zabbix
 
-- meta: flush_handlers
-
 - name: ensure chr's key is present
   apt_key: data="{{lookup('file', 'chr.gpg')}}" state=present 
+  notify:
+    - update apt cache
   tags:
     - packages
     - repos 
@@ -59,3 +68,4 @@
     - zabbix
     - chr
 
+- meta: flush_handlers