key_identity/1 calls exit/1 (a simulated HSM/key-server timeout). safe_callback's catch clause must contain it -> :invalid_key_handle, not a crash (mirror of AnchorExitingKeyHandle).