storePendingLastDeviceRecoveryKeyPair

Stores the replacement key pair of a last-device recovery. Throws IllegalStateException if one exists already (a pending key is never replaced silently) or if a device recovery or a routine rotation is pending. The active key is not touched.