Do TP-based HSS key expiry in publisher reactor.
This is what I was talking about in the meeting this afternoon.
I'm particularly interested in whether you agree that the previous approach was (at least in theory) racy, and whether you think the new approach is correct.