As a user, I should be warned if my contact's account is compromised and their security keys are reset even if I haven't verified them.

[dbkr]

There are two parts to this:

1. Being able to see this on all the devices that logged in before the point the user changed their key. The code we now have in the js-sdk can do this.

2. Being able to see when a user changed their master key even if the device I'm using was logged in after the point they changed it. This will require uploading a signature making a weaker assertion, ie. that we've seen that key for that user at a given point in time (rather than that we have verified the ownership of the key out-of-band).