so, here it is the problem with the InvalidGeneration Errors (after having sorted out the insert-in-generation-order). If we return here the last known generation for the target, all the deferred inserts (for each decrypted document) will fail the _validate_source check, since they will have lesser generation ids that the last one known.

@andrejb: do you think that we can store the new_generation and update it after we've inserted all the decrypted docs, instead of returning it here?