DeviceAuthenticationRotationPolicy
An application's policy for routine device authentication key rotation (docs/device-authentication-rotation.md): rotate once the registered key is at least maxKeyAge old. The library has no default policy and never applies one on its own; the application passes it to SecureMessageClient.evaluateDeviceAuthenticationRotation or SecureMessageClient.rotateDeviceAuthenticationKeyIfNeeded when it chooses.
maxKeyAge must be positive. Duration.INFINITE disables age-based rotation: no key is ever due.