Fixing an Identity Crisis should generate a new Protect key

If an IDC fix needs to generate a new shadow blog, it should also generate a new Protect key and store that on the site. Currently, we retain the old key, and then it becomes difficult (or impossible) for our HEs to find the Protect data when needed.

(Internal note: see linked issue for more details)

Start by locating the Identity Crisis fix flow that creates a shadow blog and then trace where the site's Protect key is retained or stored. Confirm the current behavior and review the linked issue for the missing context. Done means an IDC fix that creates a new shadow blog also generates and stores a new Protect key on the site.

Written by the indexing model from the issue text.