I’m really surprised this is even possible. Isn’t renewing keys every year as simple as setting a cron job (or whatever the google equivalent is)? How does it even happen that a large organization can forget to renew keys multiple years in a row?