Build for two live keys at once: accept the old and the new during an overlap window, then retire the old. Put rotation on a schedule and let it run unattended, so the path is exercised long before you need it. Rehearse the emergency version too — pick a key, declare it burned, rotate it, and time how long until the last consumer stops using it.

Keys that are physically bound to hardware or printed into a device at manufacture cannot be rotated in place; for those, plan replacement at the device level and keep the rotatable layer above them. A short-lived key that expires faster than you could detect a compromise does not need separate rotation machinery.