Merge pull request #1104 from kenyon/refresh-on-expired-subkeys