Rotating your keys
Replace a signing key without invalidating existing audits.
TODO: write me. Suggested skeleton:
- When to rotate (cadence, compromise, key handoff).
- The mechanics: new key generation, signing the rotation in the log, the generation/capability bookkeeping.
- What consumers see during the rotation (no break in trust if they update before the old key’s grace window ends).
- Recovering from a compromise vs a planned rotation.