Never keep a key longer than 90 days. Here is our recommended zero-downtime rotation script.