It is possible to insert duplicate keys in PSBT after #519. The insert_pair function does not check for PSBT_GLOBAL_XPUB or PSBT_GLOBAL_VERSION for Global struct and inserts them into unknown types. The easy(and correct) solution is to check these in insert_pair method as we do for other fields.

However, I think we need to revise the Map trait, make it private so that we cannot use insert_pair and users should directly interact with psbt structure fields to mutate them. I prefer doing this because I think nobody really uses the Map trait for using psbt. If we end doing this, we still need to design so that the merge method should be available as a psbt API.