There are a few issues here:

1. The output if you try to delegate to a delegated role can include two warnings that may be misleading, as it is not made clear in standard out that they are warnings:

   •   logger.warning(repr(target_filepath) + ' is not located in the'
      ' repository\'s targets directory: ' + repr(self._targets_directory))
     

   • A warning that indicates that the verification keys have "already been used" if they are already in the keydb for any reason (which does not require that another role already has used them).

2. The tutorial doesn't tell you how to deal with writing delegated roles, which requires that you mark the role (and timestamp and snapshot at least) as dirty, every time.