lock metadata write with postbox key

[lwin-kyaw]

Can we Lock the metadata write with postboxKey or OAuthKey instead of tKey.privateKey?

Issue background

This PR is related to MPC Corekit concurrent sign ups issue, Web3Auth/mpc-core-kit#115 and Web3Auth/mpc-core-kit#131.
When a new user log into MPC-CoreKit with new email address, concurrently (This is edge case and not a very ideal case in the real scenario), each login session produce different keys (private keys, tss pubkeys) and shares. And also each session write different metadata to the metadata service, resulting in race condition. Normally, there's a LOCK to prevent race conditions before writing to metadata service. However, this metadata lock is tied with tKey instance private key (which is different in each login instance in case of concurrent sign ups), so the METADATA LOCK doesn't really prevent concurrent writing to metadata server and saving different metadata states for one account.
Even though, user does not encounter any error during the concurrent sign ups, there is an issue when the same user (same email) log into another app (same email/login with different web3auth_client_id). For more info about the issue, please refer to this issue.

Expected behaviour

When user does the concurrent sign ups (login with new email), only the first instance should be allowed to set the metadata and all the later instances should throw an error (LOCK Error) since one instance has already acquired the LOCK for writing metadata to server.

Proposed solution

Currently, the METADATA LOCK is tied to tKey.privateKey and it's not really preventing the write for concurrent sign ups since each signup creates new private key.

So, instead of implementing lock with tKey.privateKey, is it possible to replace with tkeyServiceProvider.postboxKey or OAuthKey which we get from the logins/signups?

Regardless of the concurrent logins/signups, all the instances will have the same OAuthKey, so we should be able to prevent the concurrent metadata writes for same account if we could use OAuthKey to LOCK the metadata write. This will prevent multiple writes issues as well as solving the factor not present issue which we currently encounter in concurrent logins

[lwin-kyaw]

Since I'm not very sure is it possible, I will mark it as a draft for now. Will mark as ready after discussing with team.