The vast majority of transactions will have just one tx pubkey, but a bug with cold wallet signing caused two such keys to be there, with the second one being the real one.