@kaepora @a_greenberg @matthew_d_green That was my thought, it can't simply be rotating new keys (like creating new random ones like in DNSsec), but either something like forward security encrypting the new keys with a fixed key, or key derivation like Bitcoin.