fn is_rotation_due(slot: &KeySlot, now: DateTime<Utc>) -> Option<DateTime<Utc>>
Some(retire_at) when this slot’s rotation is due. Same field-pair as active_keys_at, opposite sense.
Some(retire_at)
active_keys_at