sealDeviceAuthenticationRotationKey

The whole pending replacement key pair of a routine device authentication key rotation (docs/device-authentication-rotation.md). Its own record type, so it never opens as the active or the recovery key or the other way round.