anchor.diff:  unavailable token.  When a recovery is required, an operator initiates the
   recovery process on the CN.  This recovery process on the CN will decrypt the
   current `recovery_token` value for the lost token that was created during the
  -lost token's CreateToken request or a subsequent `CreateRecoveryToken` request.
  +lost token's CreateToken request or a subsequent `CreateToken` request.
   For some TBD amount of time, earlier `recovery_token` values may also be allowed
   to account for propagation delays when updating recovery configurations using
  -the gossip protocol. KBMAPI may also optionally periodically purge members of
  +changefeed. KBMAPI may also optionally periodically purge members of
   a token's `recovery_tokens` array that are sufficiently old to no longer
   be considered valid (even when accounting for propagation delays).
   
  
positive.code: If the serial number is not part of an allowed range, a
  409 Conflict + InvalidArgument error is returned.
  
  In addition, a recovery key is generated by KBMAPI and stored as part of the
  token object.  This should be a random string of bytes generated by a random
  number generator suitable for cryptographic purposes.
  
  
negative.code:     "cn_uuid": "15966912-8fad-41cd-bd82-abe6468354b5",
      "guid": "97496DD1C8F053DE7450CD854D9C95B4",
      "pin": "123456",
      "recovery_tokens": [{
          "created": 123456789,
          "token": "jmzbhT2PXczgber9jyOSApRP337gkshM7EqK5gOhAcg="
      }, {
          "created": 2233445566,
          "token": "QmUgc3VyZSB0byBkcmluayB5b3VyIG92YWx0aW5l"
      }],
      "pubkeys": {
         "9e": "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYA...",
         "9d": "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYA...",
  