When a user utilizes the new "reset password" a warning pops-up informing the user that the back-end noticed the change in security keys. This is an excellent alert and great functionality update.
With that said, I did the pop up alert even though I did personally provoke the action and reset my keys in the process. I could see this being a bit confusing to many users. Perhaps not early adopters but users less familiar with security concerns with crypto.
Here's my recommendation:
Without adding a bunch of additional logic updates(tons of items on the plate i'm sure) that would cross reference the IP etc, changing the verbiage would be a nice improvement.
"If you recently reset your password at(timestamp in strftime, example: Thu, 21 Jul 2016 02:39:19 PST) this alert was most likely prompted by this action, otherwise your immediate attention is needed"