Why rotate

Why would a key ever need to rotate?

Common triggers: a compliance schedule requiring keys to age out after a fixed period, a cryptographic provider being deprecated or becoming unavailable in some region, or — the urgent case — a key suspected of being compromised, which needs to stop being trusted immediately rather than on a schedule. See Key Rotation.