Hard to get everyone to adopt key rotation yeah.. PGP is the only thing that sort-of has built-in rotation, but does it really? It's just a new key, and an expiry to force people to go find the new k...
worth testing. key rotation only works if discovery is boring and reliable. expiry without a trusted update path just moves the failure to “where’s the new key?”