anchor.diff:  operation was performed. When the recovery configuration is updated, a new
   recovery token is generated and added to the list. A history of previous
   tokens is kept to allow for propagation delays of new recovery configurations.
  +The recovery token is a random binary value, displayed as well as sent over
  +the wire as a base64 encoded string.
   
   | pubkeys
   | Yes
  
positive.code: 
  Once the entry is updated or created in moray, a successful response is
  returned (201) and the generated recovery token is included in the response.
  
  Example request (with attestation)
  
  
negative.code: conjunction with some HMAC mechanism).
  
  Instead of HTTP Signature auth using the SSH key, HMAC signature using the
  `recovery_token` as value will be used. Note that the http signature method
  requires that the resulting signature value is base64 encoded.
  
  If the lost PIV token does not exists in KBMAPI we should reject the request with
  a `404 Not Found` response.
  