Rotate Key

Revoke the current active key (24-hour grace) and issue a new one. Returns the plaintext, which is also re-revealable later via GET /v1/account (at-rest encrypted).