key rotation is easy: have a primary key that you only use to attest randomly generated app keys. similar to web sessions or a bare bones DID. you could rotate every message, and later claim that the nsec for that one message was leaked unfortunately no one seems to want to do it 🤷🏻‍♂️ ...