Added clarification on why waiting one TTL at least, and a note explaining our conservative approach to key rollover