Handling master's key change on minion - re-authentication to master

Description of Issue/Question

What is the proper way to re-auth minion to upgraded master (master which got its keys changed)?
I have limited access to minions, some of them are Windows minions

Setup

Regular salt master - minion setup

Steps to Reproduce Issue

1. stop salt-master
2. generate new master keys salt-key --gen-keys master
3. put keys to /etc/salt/pki/master
4. start salt-master

It doesn't matter if you previously deleted minion from master via salt-key -d
As long the minion keeps master's key somewhere in salt/pki/minion/minion_master.pub it seems that changing keys on master is unsupported. Am I right?

This is a problem for me because I have salt master deployed in container
Sometimes I want to upgrade salt by simply replacing the container

Is the only solution to manually remove minion_master.pub from minion?
Maybe there is some configuration option on minion to relax this requirement?

Versions Report

any version afair

Start with the salt-key workflow and the minion handling of salt/pki/minion/minion_master.pub. Trace how a minion validates the master's key after the master keys are regenerated, including the Windows-minion path if covered. Done means the supported re-authentication behavior or configuration option is defined and verified for the described key-rotation sequence.