We're only returning the STR with the response as an optimization (consciously or not), since an omniscient client would know which epoch we're in and when exactly to fetch the new STR. See the discussion here about syncing clocks in practice though #74 (comment)
Any STR that passes the checks in updateSTR will be stored and used by the client, regardless of whether the rest of the checks pass / fail, and that's fine since it contains proof of being issued. The rest of the checks are tangential to maintaining the STR hash chain and knowing which epoch we're in.
There are questions about how the client recovers in the face of equivocation and whatnot
See Arlo's comment in https://github.com/coniks-sys/coniks-go/commit/80e453caa501ea639c149e7af8f507b3ed6b0ed4#commitcomment-19804686
Also, open problem from coniks.org (https://coniks.cs.princeton.edu/research.html#openproblems)