cmd: Allow SYSTEM_SECRET key rotation about hydra HOT 4 CLOSED

Let me know if you have any ideas how to improve this. Best practices, specs and ideas alike :)

from hydra.

Instead of a flag, JWKs should have an exp claim.

from hydra.

For standard, regular key rotation that are meant to prevent key abuse, I would recommend a period of time where the old and new keys could be used. Basically the maximum expiry period for anything that would've been encrypted or signed with the old key.

If an existing key has been compromised, it should be replaced instantly and anything encrypted with the old key should be considered unsafe anyway and discarded. Locking during the replacement process would be nice, but ultimately there is going to be failing messages at some point if you're not respecting the previous keys anyway.

from hydra.

JWK Rotation is now implemented by adding another key (pair) to the existing set.

from hydra.