Allow clients to avoid invalidating all resources

Allow key identity generators to define resources that don't need to be
invalidated.