Key RotationReplacing encryption keys on a schedule or after incidents to limit blast radius from key compromise.