I wonder if we could force the session to have a particular key and then validate that the session info included in the session is some exact string that we expect it to be.

I'm concerned someone could change the contents of encrypted_session_key() without realizing it will break all session tracking for tracking log consumers. A failing test might help communicate that to them?