kbfs unable to access private directories

I added two new devices and now neither of them can access kbfs...

```
[jugs@slap ~]$ keybase version
Client: 5.0.0-20191114203213+f73f97dac6
Service: 5.0.0-20191114203213+f73f97dac6
```

```
2019-11-18T14:07:50.574241-05:00 ▶ [DEBU kbfs(FBO 82cefc7b) folder_branch_ops.go:7271] 1a4 [duration=428.346162ms] rekeyLocked done: {DidRekey:false NeedsPaperKey:false} This device does not yet have read access to directory /keybase/private/jugs, log into Keybase from one of your other devices to grant access: No secret key available
github.com/keybase/client/go/kbfs/libkbfs.(*CryptoClient).DecryptTLFCryptKeyClientHalfAny
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/crypto_client.go:219
github.com/keybase/client/go/kbfs/libkbfs.(*KeyManagerStandard).getTLFCryptKeyParams
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/key_manager.go:288
github.com/keybase/client/go/kbfs/libkbfs.(*KeyManagerStandard).getTLFCryptKey
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/key_manager.go:173
github.com/keybase/client/go/kbfs/libkbfs.(*KeyManagerStandard).GetFirstTLFCryptKey
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/key_manager.go:67
github.com/keybase/client/go/kbfs/libkbfs.getMDObfuscationSecret
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/md_util.go:615
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).setObfuscatorSecret
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:1844
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).setHeadLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:1868
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).getMDForWriteOrRekeyLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:2381
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).getMDForRekeyWriteLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:2564
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).rekeyLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:7269
github.com/keybase/client/go/kbfs/libkbfs.newRekeyStateStarted.func1.1
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/rekey_fsm.go:361
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).doMDWriteWithRetry
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:4654
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).doMDWriteWithRetryUnlessCanceled.func1
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:4705
github.com/keybase/client/go/kbfs/libkbfs.runUnlessCanceled.func1
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/util.go:36
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:1357 [tags:REKEYID=uuWA7AATmMaT6QlI4FS8Ig]
2019-11-18T14:07:50.574434-05:00 ▶ [DEBU kbfs(RekeyFSM) rekey_fsm.go:364] 1a5 Rekey finished with res=libkbfs.RekeyResult{DidRekey:false, NeedsPaperKey:false}, error=This device does not yet have read access to directory /keybase/private/jugs, log into Keybase from one of your other devices to grant access: No secret key available
github.com/keybase/client/go/kbfs/libkbfs.(*CryptoClient).DecryptTLFCryptKeyClientHalfAny
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/crypto_client.go:219
github.com/keybase/client/go/kbfs/libkbfs.(*KeyManagerStandard).getTLFCryptKeyParams
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/key_manager.go:288
github.com/keybase/client/go/kbfs/libkbfs.(*KeyManagerStandard).getTLFCryptKey
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/key_manager.go:173
github.com/keybase/client/go/kbfs/libkbfs.(*KeyManagerStandard).GetFirstTLFCryptKey
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/key_manager.go:67
github.com/keybase/client/go/kbfs/libkbfs.getMDObfuscationSecret
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/md_util.go:615
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).setObfuscatorSecret
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:1844
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).setHeadLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:1868
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).getMDForWriteOrRekeyLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:2381
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).getMDForRekeyWriteLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:2564
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).rekeyLocked
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:7269
github.com/keybase/client/go/kbfs/libkbfs.newRekeyStateStarted.func1.1
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/rekey_fsm.go:361
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).doMDWriteWithRetry
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:4654
github.com/keybase/client/go/kbfs/libkbfs.(*folderBranchOps).doMDWriteWithRetryUnlessCanceled.func1
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/folder_branch_ops.go:4705
github.com/keybase/client/go/kbfs/libkbfs.runUnlessCanceled.func1
/root/build/gopaths/amd64/src/github.com/keybase/client/go/kbfs/libkbfs/util.go:36
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:1357 [tags:REKEYID=uuWA7AATmMaT6QlI4FS8Ig]
```

I am logged into multiple devices but I can't see how to grant access from any of them.

Start with the reported call path in go/kbfs/libkbfs/crypto_client.go, key_manager.go, md_util.go, and folder_branch_ops.go, then inspect the rekey flow in rekey_fsm.go. Reproduce the private-directory failure after adding devices and determine why the new device lacks read access; done means it can access the private directory and the failure is covered by an appropriate test.

Written by the indexing model from the issue text.