Method rotate

nodedb/src/control/security/keystore/vault.rs:197–212

(&self)

    }

    async fn rotate(&self) -> Result<Zeroizing<[u8; 32]>> {
        let old_ciphertext = self.read_ciphertext_blob()?;

        // Rewrap with Vault (no plaintext leaves Vault during rewrap).
        let new_ciphertext = self.rewrap_with_vault(&old_ciphertext).await?;
        self.write_ciphertext_blob(&new_ciphertext)?;

        // Decrypt the new ciphertext to get the new plaintext key.
        let key = self.decrypt_with_vault(&new_ciphertext).await?;
        info!(
            mount = %self.mount,
            key_name = %self.key_name,
            "Vault transit key rotated successfully"
        );
        Ok(key)
    }
}

fn decode_32_byte_b64(b64: &str) -> Result<Zeroizing<[u8; 32]>> {