reggie rotate <target>
Derives a new signing key from your active identity (different HKDF info), signs a rotation record with the old key, and anchors the rotation on Sigil. Future versions of the entry use the new key; old versions remain verifiable forever.
See Signing keys for the underlying mechanics.