only create new key on password change if a recovery key exists or if the user don't have any private/public keys