keys: don't generate user and user session keyrings unless they're accessed