Key rotation without bloat

I'd like to be able to use keytrace for code signing purposes, where good hygene is often to have relatively short lived keys.

The old key attestations are still needed, so people can verify old code, code created with a key that was valid for that window.

I'd like some UX affordances to help manage this problem. I don't want people to be overwhelmed with old keys, but able to go back and look. I want them to be able to find keys that are meant for a certain time. I'd love to have declared what the valid use times are for keys.

I sort of imagine a claim stack, an ability for me to declare a sequence of keys where I can upsert a new one, roll off an old one. Ideally this allows >1 key at a time to be active, but declared as part of a group.

The issue describes key rotation, historical attestations, time-bounded validity, and a claim-stack UX, but names no files, tests, or entry points. Clarify the intended data model, user flows, and acceptance criteria with maintainers before identifying an implementation location.