Super short version: Keystone appears to be the Google auto updater service. It has a bug that causes it to unlink /var, and since that's sort of an important piece of the OS, its absence breaks stuff.