Move a vault to a new owner key

If the owner loses their key, guardians vote anonymously for a new vault ID that the owner generated with a fresh key. When enough guardians agree, the vault (with its recipients and policy) moves to it. Any check-in by the old key cancels the vote.