To test: When the wallet passphrase is changed, is it possible for the old master key to end up in the wallet.dat file, or is it guaranteed to be overwritten? If it can end up in the wallet.dat file, then the wallet should be rewritten when the passphrase is changed.