Any new entries will get the correct key, so changes to them will be idempotent. The only risk is a race for the put operation on the new idkey... which we resolve by letting the loop drop the old user entry on the floor in such cases. 

I am not against holding a lock, but it would need to be a readwrite one which would make the getOrCreate complex unless we just use the readwrite lock to differentiate between rekeys (i.e. that needs a write lock because more than one key is affected at any point in time) and normal operation (which can write while holding the read lock as long as only touching a single key)