Wait to send a WRONG_KEYS error until key statuses have propagated.
Also, check for expired keys and fire the EXPIRED error from the key
status handler, not from 'waitingforkeys', which is not yet available
everywhere. The EXPIRED error will suppress any WRONG_KEYS error that
might otherwise fire when 'waitingforkeys' happens.
Finally, do not trigger track restrictions based on expired keys. This
means EXPIRED will never be followed by ALL_TRACKS_RESTRICTED.
This provides more deterministic behavior in tests and clearer
diagnostic signals for app developers.
Change-Id: Idd0f91fdd6442125661b9593ecaad0b57b81625c