Make sure the device recovers from policy loss in the consumer case.

chrome/browser/chromeos/login/user_manager_impl.cc

Index: chrome/browser/chromeos/login/user_manager_impl.cc
diff --git a/chrome/browser/chromeos/login/user_manager_impl.cc b/chrome/browser/chromeos/login/user_manager_impl.cc
index f12e0db8f6fe451570c1422cf726c24c9b2ba245..51e088144c81fd62cf8ed1a5624559333e4dee78 100644
--- a/chrome/browser/chromeos/login/user_manager_impl.cc
+++ b/chrome/browser/chromeos/login/user_manager_impl.cc
@@ -291,6 +291,7 @@ UserManagerImpl::UserManagerImpl()
       is_current_user_owner_(false),
       is_current_user_new_(false),
       is_user_logged_in_(false),
+      key_store_loaded_(false),
       observed_sync_service_(NULL),
       last_image_set_async_(false),
       downloaded_profile_image_data_url_(chrome::kAboutBlankURL) {
@@ -810,6 +811,19 @@ void UserManagerImpl::NotifyOnLogin() {
   WmIpc::instance()->SetLoggedInProperty(true);
 #endif
 
+  LoadKeyStore();
+
+  // Schedules current user ownership check on file thread.
+  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
+                          base::Bind(&UserManagerImpl::CheckOwnership,
+                                     base::Unretained(this)));
+}
+
+void UserManagerImpl::LoadKeyStore() {
+  CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  if (key_store_loaded_)
+    return;
+
   // Ensure we've opened the real user's key/certificate database.
   crypto::OpenPersistentNSSDB();
 
@@ -824,11 +838,7 @@ void UserManagerImpl::NotifyOnLogin() {
     // Note: this calls crypto::EnsureTPMTokenReady()
     cert_library->RequestCertificates();
   }
-
-  // Schedules current user ownership check on file thread.
-  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
-                          base::Bind(&UserManagerImpl::CheckOwnership,
-                                     base::Unretained(this)));
+  key_store_loaded_ = true;
 }
 
 void UserManagerImpl::SetInitialUserImage(const std::string& username) {