- if current key pair is expired, it'll be extended for a day first - new key pair will be signed by the old key