William, I've tried restoring key3.db, cert8.db and secmod.db but it didn't help.
Since IPA server is a VM, I was able to try different things on VM's clone, and
fortunately (with the luck) I fixed the problem.
Basically I tried different daily backups that I have, and with one of them, after restore
was done, 389ds start failed with messages like:
libdb: BDB2506 file changelog/id2entry.db has LSN 21643/9352420, past end of log at
21243/6180
libdb: BDB2507 Commonly caused by moving a database from one database environment
libdb: BDB2508 to another without clearing the database LSNs, or by removing all of
libdb: BDB2509 the log files from a database environment
dbp->open("changelog/id2entry.db") failed: Invalid argument (22)
And after just removing a file changelog/id2entry.db, I was able to quickly start 389ds.