Feature request: rotate cookie store session secret

For security I'd like to rotate the cookie store session to a new secret every few days without the disruption of a restart, and without invalidating existing unexpired sessions using the old secret.

The overlap duration between the old and new secrets would be about the same as the session TTL.

One way to do this would be to allow the client code to add new secrets and remove old ones, and have the middleware to support decrypting sessions with all currently valid secrets.

Another way which I think is simpler and easier to implement, is to allow the user to provide a secret-generating function, and to have the middleware automatically rotate the secrets at the same frequency as the session TTL. This way the middleware wouldn't need to provide a stateful API for adding/deleting secretss, and the user could focus on providing the :secret-generating-fn without having to deal with the rotation logic.

Is this something you would consider adding, or is there a way to do this already that I missed?

The issue names no files, tests, or entry points. Start by locating the cookie store session middleware and reading how session TTL and secret handling currently work; clarify whether the supported design should accept multiple active secrets or generate and rotate them automatically. Done means unexpired sessions survive secret rotation without a restart, while expired sessions follow the existing TTL behavior.