add support for removing private keys during EKM sync (and possibly recovering when syncing from 0 keys)

[tomholub]

I forgot to submit my review earlier, so here are some unsubmitted comments from before. From the look of it, I could probably merge it before these are resolved. I'll take one more look and potentially merge it now.

Originally posted by @tomholub in #4477 (review)