Can KeyFetchTokens be ephemeral?

KeyFetchTokens are already single-use. Making them also ephemeral simplifies the data model. By ephemeral I mean auto-expiring and maybe "volatile" storage.

### Benefits

* no data references from Account -> KeyFetchToken required
* unused tokens don't need to be GC'ed when an account is deleted

### Drawbacks

* clients may attempt to use an expired token

### Problem

The current implementation has no limit on the number of KeyFetchTokens that an account has active and those tokens are never cleaned up if the account is deleted. Ephemeral tokens allow us to keep multiple active tokens without worrying about leakage or managing them from the account.

Another alternative is to only have one (or a fixed N) active token at a time, but then dueling clients could live-lock each other and never get keys.

TLDR ephemeral tokens can make my life easier :)

@warner @ckarlof thoughts?