[schoen]

Is that process automated / formalized, or manual / informal?

[evbogue]

Nope, you just generate a new keypair and link to it. It rotates, has done so for years.