How to change encryptionPassphrase after RBD is encrypted

Dear.
According to the security requirements, the encrypted key needs to be modified periodically, and there seems to be no relevant function in the rook ceph? How should I get to modify encryptionPassphrase?

myconfig:

> user-ns-secrets-metadata-test: |-
{
"encryptionKMSType": "metadata",
"secretName": "storage-encryption-secret",
"secretNamespace": "default"
}

No source files, tests, or entry points are mentioned. Start by tracing how `encryptionPassphrase`, `encryptionKMSType`, `secretName`, and `secretNamespace` are handled in the RBD encryption configuration, then determine whether passphrase rotation is supported; done should be a documented, validated rotation path or a clearly scoped implementation plan.

Written by the indexing model from the issue text.