@silverpill One way to implement key rotation would be to implement a hybrid solution, similar to how nomadic identity is handled in the Zot and Nomad protocols.

Your fediverse address is tied to a server, but your identity is not. You can change your server & address, and still keep the same identity.

You could use such a system to handle key changes for an identity. Even though the identity itself is nomadic, an authoritative server can announce a key change for an identity, similar to how an authoritative DNS server can announce changes to a domain name's IP address.

Of course, none of that uses DIDs. But you might be able to take some of the concepts and apply it to DIDs.