We're using the IronClaw enclave for our agent secrets. Right now the master key is sealed to the enclave's identity at launch. That's fine until you need to rotate it. The docs say you can provision a new master key, but I haven't seen a clear example of doing it live.

My main question: is there a way to push a new master key to the enclave without terminating all existing agent sessions? I assume the new key would be used for any new data sealed after rotation, while the old key stays available to decrypt previously sealed blobs. But how does that actually work in the API?

I wrote a quick script to see what the current `/v1/key/status` endpoint tells me. It shows the key fingerprint and creation time, but no indication of multiple active keys.

```python
import requests
import json

base_url = "https://enclave.internal:8443"
resp = requests.get(f"{base_url}/v1/key/status", verify=False)
print(json.dumps(resp.json(), indent=2))
```

If key rotation is supported, there must be a provisioning endpoint that accepts a new key wrapped with the enclave's public key. But I'm worried about the transition period. Do you have to re-encrypt all existing sealed storage with the new key before retiring the old one, or does the enclave manage a key ring automatically?

What happens if an agent sealed a secret with the old key, and then tries to unseal it after rotation? I need to know the failure modes before I try this in production.