Renew device identity certificate automatically with EST

In our production edge devices, we use EST for automatic device identity certificate issuance and renewal. My questions are mainly related to the following part, which I couldn't really find answers in documents.
````
[provisioning.attestation.identity_cert.auto_renew]
rotate_key = true
threshold = "80%"
retry = "4%"
````

- What are the pros and cons of rotating private key? our edge devices are out in the field and we won't have any remote access to them. So it is of the utmost importance to lower the risk of not being able to renew the certificate.
- When we set `retry = "4%"`, does it mean that if the renewal fails at 80%, it will try again at 84%, 88%, and so on? Up until 100%? what will happen after 100%?

Besides these questions, we have been thinking about having a recovery plan for edge re-provisioning when certificate renewal doesn't go as expected. If that's the case and there is no disaster recovery plan, we will lose the device and there will be no way to recover it remotely. We are thinking to develop a service on device to monitor the certificate's expire time every 1 hour and compare it with the current time. If the cert is expired and no new cert has been reissued, which means EST renewal didn't go as expected, then the edge runtime should switch to symmetry key immediately. This requires having the derived device key already on the device as backup, which is doable. Does this process sound feasible? What are the best practices to materialize this scenario?

The overall aim is to of course mitigate the risk and have proper automatic recovery plan.