ESPHome adds a direct way to rotate the key used for encrypted wireless firmware updates. Put the replacement in the normal key setting and the previous value in the old-key setting; the uploader can reconnect with the previous key while installing firmware built with the new one.
The device stores only the new key. After a successful installation, the command-line tool reports that the old key can be removed. A separate option can prompt privately for a different key for one upload, without putting it in a command-line argument.