I think @TimLovellSmith is right that changing these settings would require a restart. And @jeffhandley is right that a redeploy would trigger it. We do want most of our settings to be changeable in-flight, but machine key is so tightly baked in to ASP.Net that it MUST be in the web.config, and I also want to reduce the risk of accidentally checking in secrets, which this does.

If our machine key is compromised and needs to be changed, we can take the hit of a new deployment. In general, I want to avoid doing this kind of thing too, but sometimes it's necessary. It's a hack, but a fairly clean one (no worse that the hacks we were doing to patch the web.config before deploying).