Thanks John. I took a look and it turns out that we don't actually supply the key's name given to the Katello API to Candlepin. Katello generates a UUID for the name. I don't know the historical reason as to why we don't send the name through the Candlepin but it means the comma restriction needs to be handled by Katello.
This is not candlepin bug and will be handled in bug 1665277