Function refresh_if_stale 

pub(crate) async fn refresh_if_stale(
    client: &Client,
    local_url: &str,
    auth_key: &str,
)

Fetch the keys if there is no copy yet, or it is older than 20 h. Errors leave the old copy (or none) in place: signing then falls back to the env keys, exactly as before M4d-3.