[savant]

You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter.

In this case, they are just limiting the window.

[kentonv]

Indeed, we were going to do the auto-renewal regardless, so making it every 7 days didn't really add any work.

Meanwhile I really am paranoid about long-lived keys of any sort, especially if they need to be online as TLS keys must. I wish CAs offered short-lived keys more readily (and web infrastructure supported it); I'd love to enable them for all Sandstorm properties.