The rotation is not related to the UEFI capability to check/enforce the expiration, but the capability to sign future shim/OpROMs/drivers/bootloaders.