POST /me/recovery/restore/verify
archived grants (principal = the caller) whose vault still exists at that key_version
the archived keyset, wrapped with the old AUK
POST /me/recovery/restore/verify