Fix mismatch between sort and used fields in Keypair.keyset

[koesie10]

The valid keys of a keypair were sorted on expires_at, but for determining the validity of the keys it uses not_before. Therefore, when the expires_at of a keypair did not exactly match the default rotation period, there could be a mismatch between the actual future key, and the key that was used for checking whether there was a future key.

This fixes the use case of creating one keypair for development which does not rotate by manually setting the not_after and expires_at (as in the spec).