Module key_rotation 

S10 key rotation: dual-signed ExoChain event + verifier (WEFT-107).

Security-panel protocol ([docs/weftos/k5-symposium/03-security-and-identity.md]):

1. Node generates a new Ed25519 keypair.
2. Node signs a identity.key_rotation chain event with the old key, embedding the new public key.
3. Node signs the same canonical message with the new key (possession).
4. Peers verify both signatures and update peer records.
5. Old key is revoked after a configurable grace period.

The dual signature lives in the chain event payload. Event hash linking remains SHAKE-256 as for every other ExoChain entry.

Structs

KeyRotationPayload

Dual-signed key-rotation payload embedded in a chain event.

KeyRotationVerifier

Tracks accepted key rotations for peer verification + grace windows.

Enums

KeyRotationError

Errors from building or verifying a key-rotation event.

Constants

DEFAULT_GRACE_PERIOD_SECS

Default grace period before the old key is fully revoked (24 hours).

KIND_KEY_ROTATION

Chain event kind for S10 key rotation.

SOURCE_IDENTITY

Chain event source for identity / key lifecycle events.

Functions

build_key_rotation_payload

Build a dual-signed key-rotation payload.

format_rotation_summary

Format a human-readable rotation summary for CLI output.

rotate_chain_signing_key

Perform a local key rotation on a ChainManager.

rotate_chain_signing_key_now

Convenience: rotate using RealClock.

verify_key_rotation_event

Verify a chain event that claims to be a key rotation.

verify_key_rotation_payload

Verify both Ed25519 signatures on a key-rotation payload.