hm, so I thought net80211 had a "do this deferred" but it only has taskqueues, not a callback queue for deferred things like this.

I'm okay with hand-crafted ones for now, but we should think about how to push it into the net80211 taskqueue - likely with an actual deferred callback framework there.

Ok, this looks fine. I have an 11bg rum device (RT2573) that I can test with; so once I get through the other commits I'll take a look at this one.

In D3640#78035, @adrian wrote:

I'm okay with hand-crafted ones for now, but we should think about how to push it into the net80211 taskqueue - likely with an actual deferred callback framework there.

There is only one problem:
ieee80211_node_delucastkey(struct ieee80211_node *ni)
{
...

isowned = IEEE80211_NODE_IS_LOCKED(nt);
if (!isowned)
        IEEE80211_NODE_LOCK(nt);

...

status = ieee80211_crypto_delkey(ni->ni_vap, &ni->ni_ucastkey);

...

if (!isowned)
         IEEE80211_NODE_UNLOCK(nt);

After removing locks around ieee80211_crypto_delkey() any problems with iv_key_set() / iv_key_delete() LORs / sleepable calls should go away.