partially fix #2825: authkey: rotate if it was generated in the future