updatekeys doesn't trigger when key ordering change

When changing key ordering to prioritize a decryption key over others (age key over password-protected ssh private key), sops updatekeys exit with "File already up to date" message.

updatekeys should update the encryption order of the file, since sops decrypt decrypt the file in the encryption order, rather than in the .sops.yaml key declaration order.

For example, updating .sops.yaml from:

key_groups: &encryption-keys
  - age:
    - &user_ssh_id ssh-ed25519 rtensaensuurestntreunesaruxxxxxxxxxxxx user@domain.com
    - &user_sops_age age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
creation_rules:
  - path_regex: secrets/.+$
    key_groups: *encryption-keys

to

key_groups: &encryption-keys
  - age:
    - &user_sops_age age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    - &user_ssh_id ssh-ed25519 rtensaensuurestntreunesaruxxxxxxxxxxxx user@domain.com
creation_rules:
  - path_regex: secrets/.+$
    key_groups: *encryption-keys

Start at the updatekeys command and reproduce the issue using the two .sops.yaml key orderings shown. Verify how the encrypted file's key order is compared with the configuration; done means sops updatekeys changes the encryption order and no longer reports the file as already up to date.