Without key rotation won't all accounts be compromised in the end?