rotate

Starts a rotation and returns the new current key ID. In PREPARING it finishes the interrupted start with the key ID already allocated. Throws StorageKeyRotationInProgressException while migrating or retiring; StorageEncryptionException.KeyIdsExhausted if no key ID is left; StorageEncryptionException.KeyUnavailable if the provider cannot create or return the key (the storage then still uses its current key).