Function rewrap 

pub fn rewrap(
    old: &Key,
    new: &Key,
    ctx: &Context,
    wrapped: &[u8],
) -> Result<Vec<u8>, KeyError>

Moves a wrapped key from old to new, keeping its context: the rotation step. The plain key exists only in its own locked page in between, and what it protects is never re-encrypted.

Errors

Any error unwrap gives for wrapped under old.