Master key renewal may silently fail

[dahlia]

The current implementation of master key renewal is done with SFTP write operation, and it implicitly overwrites the previous authorized_keys file. Overwriting operation might not be atomic, and may consist of two operations instead: remove existing one and write a new file. There’s a case that only first half of operations is successfully done, and then the remained half fails e.g. condition that there’s no free space in the disk.

All authorized_keys files are supposed to be confirmed whether they are well written once again before promoting the new key as the master key.