Comment by mspecter

Hi! Check out our Usenix 2021 paper on exactly this topic. The key insight is to release private keys over time:

http://www.mit.edu/~specter/blog/2020/dkim/