* check key version per key id (that is, per tablespace).
* wake encryption thread when a tablespace needs re-encryption