When fetching remote devices for the first time, we did not correctly include the cross signing keys in the returned results.

c.f. #11159