The vault: keys by handle, encrypted at rest, every change journaled.
Same handle = rotation (version bumps, change journaled). Agents only ever see the handle, never the value.
Vault is empty. Fresh start: add your first key on the left and rotate everything that ever lived in the old swarm.
Every set, rotation, reveal, and delete. Nothing happens to a key without a record of it.