changeuser doesn't edit the keys file directly; it uses keyfs.
Probably rewhack your auth server by losing the keys file and try
again.  Make sure keyfs is actually decrypting the keys file
correctly.  If the password you give at boot is wrong, it won't
be able to do this.  ("Wrong" means "not the same key that it waas
using when it wrote the file".)  Look in your logs for messages from
keyfs.