bulk rekeying after authentication works both ways