The letter addresses this. The behavior is a trade-off, and you have to decide how to handle it. For a product with a billion users, where the threat model is

The letter addresses this. The behavior is a trade-off, and you have to decide how to handle it. For a product with a billion users, where the threat model is mass surveillance, it is a good trade-off to never drop messages. For a product with more specialized users, who may be individually targeted, it is a good trade-off to not deliver buffered messages after a key change, and warn instead. There is no "best" behavior in the abstract, you have to take into account the setting.