timerTick didn’t have access to updateKeys function.
Create a packaged app

My employer’s security people were appalled by the idea of the hosted
authenticator, which can be changed anytime by the owner of the website.
I believe that for this type of application a packaged (and even better
privileged, and therefore signed) application is better.