Early key renewal doesn't work with old(er) times

Hello!

I noticed some interesting behavior that I wanted to share that _seems_ unexpected.

When I attempt early key renewal with a relatively recent timestamp (within the past few seconds or so), it works exactly as expected! Specifically I've been using the environment variable approach described here: https://github.com/bitnami-labs/sealed-secrets#early-key-renewal. **However**, when I attempt the same procedure with an older timestamp, a new key _isn't_ created.

For example, I edit the `Deployment` (perhaps not too relevant, but I did this live via an edit in [K9S](https://k9scli.io/)) to add the following stanza to the spec for the controller container:
```
env:
- name: SEALED_SECRETS_KEY_CUTOFF_TIME
value: "Fri, 10 Sep 2021 10:59:41 -0400"
```

For greater context, here's more YAML to show where exactly I placed it:
```
spec:
containers:
- command:
- controller
env:
- name: SEALED_SECRETS_KEY_CUTOFF_TIME
value: "Fri, 10 Sep 2021 10:59:41 -0400"
image: quay.io/bitnami/sealed-secrets-controller:v0.16.0
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
```

As I type this, it's 12:14 ET, which is a little over an hour from the time in the `value` field above. When I apply this, I see that Kubernetes creates the new pod, but a new secret is not created. If I again edit the container spec and change the value of the existing environment variable to a more recent time, such as `12:14:00`, I see that the pod is again refreshed and a new key _is_ created.

I dug into the code and don't quite understand why this would be happening, it seems like a fairly straightforward comparison: https://github.com/bitnami-labs/sealed-secrets/blob/d15c388248912213c930d1dc5b0f84c627bca3ea/cmd/controller/main.go#L148

I do see that the documentation specifically says to pass the "current timestamp", but I suppose I didn't read that literally.

Bottom-line, is this expected functionality?

Thanks a ton 😁 ,
Matt White

The issue points to cmd/controller/main.go around line 148 and the early key renewal documentation; read both first. Reproduce with SEALED_SECRETS_KEY_CUTOFF_TIME using recent and older timestamps, then establish whether the cutoff semantics are intended and whether the relevant behavior or documentation needs correction.

Written by the indexing model from the issue text.