From a user perspective, you'd either log out of a device and log back in (thus getting a new device key), or you can hit a big reset button on your cross-signi

From a user perspective, you'd either log out of a device and log back in (thus getting a new device key), or you can hit a big reset button on your cross-signing state if you want to blow away your master key and start over (which isn't so much rotation as revocation, but should be adequate). https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md#key-security https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro... has the details from the implementor's perspective. See also https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md#security-considerations https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro... EDIT: in theory you could also rotate all keys from a client by creating a new master signing key and then re-publishing all your existing cross-signing signatures with the new keys. This sounds like quite a good way to grandfather in untrustworthy attestations though; it might be safer to start over. The current implementation doesn't support this.