--rm-kms panics when removing first kms entry

Initially I have 2 kms entries, both different kms arns. I then successfully add 2 new kms entries. Now I have 4 kms entries, all different kms arns. I then try and remove the first kms entry and it panics:

sops --rotate --in-place --rm-kms "arn:aws:kms..." --verbose  example.yaml
[AWSKMS]         INFO[0001] Decryption succeeded                          arn="arn:aws:kms..."
[SOPS]   INFO[0001] Data key recovered successfully
[SOPS]   DEBU[0001] Decrypting tree
panic: runtime error: slice bounds out of range

goroutine 1 [running]:
main.rotate(0xe8a920, 0xc0001e6bd0, 0x7fe514270360, 0x1481040, 0x7fe514270360, 0x1481040, 0xc0000a82a0, 0x5d, 0x0, 0x0, ...)
        /home/gerryd/go/src/go.mozilla.org/sops/cmd/sops/rotate.go:58 +0xc03
main.main.func5(0xc00011ac60, 0x0, 0x0)
        /home/gerryd/go/src/go.mozilla.org/sops/cmd/sops/main.go:553 +0x14ce
go.mozilla.org/sops/vendor/gopkg.in/urfave/cli%2ev1.HandleAction(0xbf9f20, 0xd497a8, 0xc00011ac60, 0x0, 0x0)
        /home/gerryd/go/src/go.mozilla.org/sops/vendor/gopkg.in/urfave/cli.v1/app.go:490 +0xc8
go.mozilla.org/sops/vendor/gopkg.in/urfave/cli%2ev1.(*App).Run(0xc000185a00, 0xc0000d0000, 0x7, 0x7, 0x0, 0x0)
        /home/gerryd/go/src/go.mozilla.org/sops/vendor/gopkg.in/urfave/cli.v1/app.go:264 +0x590
main.main()
        /home/gerryd/go/src/go.mozilla.org/sops/cmd/sops/main.go:653 +0x2578

Oddly, I can successfully remove the second kms entry.
Trying to remove the first kms key still fails.

The sequence that works for me (starting with 2 kms keys in the file):
1. Add 1 new kms arn
2. Remove the first 2 kms arns
3. Add a second new kms arn

Start in cmd/sops/rotate.go at the reported panic location, line 58, and reproduce the issue with --rotate --in-place --rm-kms using a file containing multiple KMS ARNs. Compare removing the first entry with removing the second. Done means the first KMS entry can be removed without a slice-bounds panic.