resume
Advances a rotation by one bounded step and returns the new status: PREPARING finishes the start like rotate; MIGRATING re-encrypts up to maxRecords records and, when none are left, proves that no record uses the retiring key and retires it; RETIRING removes the retiring key from the provider (again) and ends the rotation; STABLE does nothing.