Currently this isn't working correctly, so the demo doesn't always work. For the beta test, we'll only worry about the domain having one key present. Longer term, we'll upgrade to what's outlined in the design doc for key management and rotation.