> what is stopping third parties from doing key rotations

Knowing to do so, primarily.