Rotating Credentials Is Not Revoking Them. The Revocation Unit Decides Whether You Can.

The revocation unit decides whether credential rotation can ever be atomic. It is the scope one...