KMS key rotation does not re-encrypt stored data

A practical distinction between rotating KMS key material, retiring old keys, and re-encrypting existing ciphertexts.