If there are multiple accounts and one of them have an invalid token, decryption of the token fails.
This makes other tokens to not be refreshed.

Happened to me because of 2 old accounts that are pending deletion.

I would like to suggest to just log the decryption error and just continue with tokens that can be decrypted.