AES key rotation

[heyitsanthony]

Periodically create new AES keys and associate with a revision watermark. Write new data with new AES key, decrypt old data with old AES keys. When all data below the watermark is gone, remove old AES key(s).