This is great. Wondering if the current year PGP key needs to or should also first sign the next year's key, authenticating a chain? Maybe I'm missing something about the rotation process.