Rotating keys

Three authorities, three rotations, and they do not work the same way.

cardinal oidc key rotate                  # one step; the JWKS is fetched live
cardinal ssh ca rotate <key-id>           # distribute trust first
cardinal x509 ca rotate <key-id>          # distribute trust first

The token signing key is one step because a receiver fetches the JWKS and picks up the new key on its next refresh. Both keys are published through the grace period, which defaults to the longest token lifetime any registered client is configured with. The certificate authorities are two steps because a trust store has to be updated before the new key starts signing; the agent distributes SSH authority trust itself, so that half is not a fleet-wide manual step.

The encryption keys are different again

The three keys in the configuration file (for the OIDC signing key, the SSH authority and the X.509 authority) seal what is in the database. Rotating one of those is not covered by any command here, and they must differ from each other.