- A signed journal entry can announce that a key is revoked or rotated. - Useful when a private key is compromised or replaced. Fields: - `sig_type`: `"key-rotation"` - `old_pubkey`: revoked key - `new_pubkey`: new key - `rotation_note`: optional message - `signed_by`: previous trusted signer