I’m personally not a huge fan of expiry - if your key is compromised within its lifetime, it can be compromised again, attack complexity increases but is not mi

I’m personally not a huge fan of expiry - if your key is compromised within its lifetime, it can be compromised again, attack complexity increases but is not mitigated and requires a bunch more effort (refreshing, graceful fail logic, etc). Windows implements DPAPI, which is used to encrypt stored secrets on disk keyed with the users password sha1’d (and previous sha1 keys encrypted with the newest password). That way a file system compromise isnt a password compromise, at least directly. More hardcore is hardware based modules, TPM and yubikeys are in this space, they use pub/private keys so the secret is no longer pre shared. Other hardware security modules also exist which are more full fledged. The former ultimately guarantee authentication but not session security, the latter can potentially do both afaik.