Regenerated keys were being filtered as deleted because the deletion marker in Keystore2Interceptor.deletedSoftwareKeys survived past the regen call. Clear the marker at both software and TEE generation paths so the next getKeyEntry returns the fresh key instead of NOT_FOUND.