This is such a non-issue. You build in flags in the clients that are server activated "needs-reencrypt". After login (local client) flag is read from server and

This is such a non-issue. You build in flags in the clients that are server activated "needs-reencrypt". After login (local client) flag is read from server and logic begins. You notify the user their vault needs stronger encryption. They can choose to continue and enter password, skip for now or ignore for 1 month (or something more reasonable). The point is you explain why you do this. Start the message with "We care about your encryption" and go from there to explain that they need you to upgrade because the don't know your master key, they need your help to do it. Adding this kind of behavior should be their core business. Apparently it's not.