pub async fn sweep_expired_keys(db: &Db) -> Result<()>
Run on a schedule, not by a request: a client must not choose when its request pays for it.