keys.delete-keeper: Only do one pass through the file system.

Rather than doing a pass to check that we won't orphan any recovery keys
and then another pass to figure out which recovery keys need modifying,
gather enough information in the first pass that we can do the second
just from the recorded data.