Devices with changed device keys are displayed confusingly in the UI #3415

Suppose one of our devices has its ed25519 or curve25519 key replaced -- for example, by a malicious homeserver admin (or by a buggy client together with element-hq/synapse#18511; we have observed that Element Classic does this occasionally).

The rust matrix-sdk-crypto ignores any updates to devices in which those keys have changed. Other users will therefore continue to see the device as verified even if its not, until they log in on a fresh client. The sudden appearance of an unverified device -- possibly months after the actual change -- will then be surprising at best.

Worse yet, our own device list in other clients will also continue to show that device as verified. This will lead to extreme confusion and worry when other people report seeing an unverified device that we cannot ourselves see.

#2374 is related in that it is about the fact that we allow you to replace those keys; however even if we fix that, we still have this issue if the homeserver admin changes the keys.