As part of #4019, `key_rotator` also needs a revamp, but it's working as-is and that change is big enough. Come back to it.
