DeviceAuthenticationRotationId
Identifies one rotation statement: 32 bytes, SHA-256 over the domain KSecureMessage-DeviceAuthRotationId-v1 and the statement. The server records the ID of the rotation that installed a device's current key, so a retry of the same rotation is recognized. It is never an authorization.