when the function signature is ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) you know it’s a good one