Decide on, and implement, behavior for inconsistent onion service state
In the longer term, we should make sure that we can start up with a fairly arbitrary combination of keys and state files, and have the onion service code either recover somehow, or display a reasonable error.
In the shorter term, we should identify whether there are any error cases here that we think are likely to happen in practice, and implement them.