For running services, make sure we delete expired keys and state

We should not retain any expired keys or state longer than needed.

(This is separate from #1087, which is about handling services that are not running.)

This is required for security, and to avoid running out of disk space.