Rotating a JWT signing key the naive way logs out every user at once. Here's the kid-based rotation pattern that avoids it entirely.