serf: renamed rotateKeyQuery to newSecretQuery to disambiguate, since rotating the key is the actual swap-out