Handle cross-signing key changes when old key is cached

Ensure we handle the user resetting their cross-signing keys and notice that the ones we have cached are no longer useful. We can do this by ensuring that we always revalidate the that the private key we use matches the public key stored on the account.

Presumably if we don't have the key cached, we should prompt for the SSSS (secure secret storage and sharing) passphrase?