provide an API for rekeying (in engine.mli and mirage for now)