implement 'identity sync' which basically triggers client re-keying of identities that the server knows about but the client doesn't.  Also invalidates ids that the user has removed (probably on another device).  Also this is the proper place for revocation and key refresh to occur.  one transaction + one per key reset (though that could be consolidated)