I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried.
Key material rotation seems to be a sensible practice in general.
Key material rotation seems to be a sensible practice in general.