Key signing and verification for rotated credentials