As discussed with PeterB.
Background reading: I was tracing keyswap today for problems, and found that we were 99% done, except for the very very last bit where Moodle attempted to refresh the key. It was calling the undefined param_clean function and dying, instead of returning that the key refreshing was successful and letting the request continue.
The attached patch fixes this problem, and combined with a patch I'm submitting to Mahara, means that if you're SSOing from Moodle to Mahara and Mahara's key has changed, it'll all keep working.
This will probably fix the same case with Moodle to Moodle SSO.