Rather than messing around with the 2119 language, I suggest that we just try to explain the situation, as so.

If an implementation misses enough ConfigUpdates which include key changes, it is possible
that it will no longer be able to verify new valid ConfigUpdates. In that case, the only available
recovery mechanism is to attempt to retrieve a new configuration document, typically by
the mechanisms it would use for initial bootstrapping. It is up to implementors whether or how to
decide to employ this sort of recovery mechanism.