I think what grandparent and others are saying is that you also revoke the secrets contained in the ciphertext, e.g. if it&#x27;s an AWS key you would revoke that AWS key on AWS&#x27;s side as well as encrypting new secrets with a different encryption key.<p>Obviously this is a huge hassle and isn&#x27;t easily done with all kinds of secrets (which is what I think you&#x27;re getting at?). But it&#x27;s also often necessary.