A new key can (should) be activated only if a user can confirm that they can read messages encrypted with this key sent to a configured account recovery email.