When fetching remote devices for the first time, we did not correctly include the cross signing keys in the returned results. c.f. #11159