rotateLastDeviceRecoveryKey
suspend fun rotateLastDeviceRecoveryKey(device: AuthenticatedDevice, authorization: RecoveryKeyRotationAuthorization): RecoveryKeyRotationOutcome
Replaces the authenticated device's user's offline recovery key with the statement's new key (docs/recovery-key-lifecycle.md): authorized by the device (ServerAuth, ProtectedEndpoint.ROTATE_LAST_DEVICE_RECOVERY_KEY) together with the current recovery key's signature, proven by the new key. Throws RecoveryKeyLifecycleException and changes nothing if any check fails. From the moment this returns RecoveryKeyRotationOutcome.ROTATED, only the new key authorizes last-device recoveries, and every outstanding challenge and any pending recovery key reset of the user are gone. Device registrations, prekeys and mailboxes are not touched.