My understanding is that you create a new key in the external key management service, re-encrypt all applicable data in Workspace with the new key and then revo

My understanding is that you create a new key in the external key management service, re-encrypt all applicable data in Workspace with the new key and then revoke/delete the old key. All this is API-based, of course, so it can be automated. (Testing Cunningham's Law here)