Currently, the key manager is proactively refreshed on tenant migration donor and recipient primaries. This avoids having to check for new external keys every time a signed cluster time is received (note this is not just when an unrecognized keyId is seen because keyIds may be the same for internal and external keys).

Similarly, secondaries for both replica sets will need to proactively cache these external keys at some point before the migration commits, otherwise they will be unable to validate signatures from the other after the migration cutover.