Update: turns out that tootctl accounts rotate is a "break federation with GoToSocial" button; be warned