It's possible that publishing one-time keys to the identity service appears to fail to the client, but actually succeeds on the identity service.
If we don't mark the one-time keys as published in this scenario, we risk them being vended to a client by the identity service, and then re-uploaded again to the identity service. Since we don't keep track of used one-time keys in the identity service, this could result in the identity service vending the same one-time key to two different clients. Furthermore, the second client will fail to initialize a session, since the one-time key has already been used up.
To avoid this issue, our plan is to always mark one-time keys as published right before an attempt is made to publish them to the identity service.