Switch Prod Keys 14.1.2 Online
It is important to clarify that prod.keys (Production Keys) and title.keys are proprietary encryption keys extracted from the Nintendo Switch hardware. These keys are required by emulators like Ryujinx or the now-discontinued Yuzu to decrypt and run retail game files.
Because these keys are copyrighted software owned by Nintendo, downloading them from third-party websites is considered software piracy. To stay within legal and ethical boundaries, users should "dump" these keys from their own legally purchased Nintendo Switch console. 🔑 Understanding Prod Keys 14.1.2
Release 14.1.2 was a minor firmware update for the Nintendo Switch. In the emulation community, "Prod Keys" act as the "handshake" between your game files and the emulator. ✅ Why Version 14.1.2 Was Significant
Compatibility: This version supported games released during that specific window (mid-2022).
Stability: It addressed minor system bugs, ensuring smoother decryption for certain titles.
System Architecture: It maintained the standard RSA encryption used in previous 14.x.x iterations. ⚠️ Performance & Limitations
Version Mismatch: Using 14.1.2 keys with a game that requires higher firmware (e.g., version 17.0.0+) will result in the emulator failing to launch the game.
Hardware Extraction: The process of obtaining these keys requires a "Launch Day" (V1) Switch or a modded V2/OLED/Lite console.
Security: Third-party "key sites" often bundle malware or trackers with their downloads. 🛠️ The Ethical Way to Obtain Keys
If you are looking to set up an emulator, the most secure and legal method is to use Lockpick_RCM.
Enter RCM Mode: Use a jig on your Switch to enter Recovery Mode.
Payload Injection: Use a tool like TegraRcmGUI to push the Lockpick_RCM payload.
Dump Keys: Navigate the on-screen menu to "Dump from SysNAND."
Transfer: Move the prod.keys file from your SD card (/switch/ folder) to your PC. 📊 Summary Comparison 14.1.2 Prod Keys Current Latest Keys (18.x.x) Game Support Games up to mid-2022 All current releases Stability Very Stable Required for new DLC/Updates Legal Status Copyrighted Material Copyrighted Material Availability Legacy / Archive Active / Current
If you are trying to set up an emulator for the first time, I can guide you through the process of: Checking if your Switch is unpatched (hackable) Finding the correct Firmware files to match your keys Optimizing Ryujinx settings for your specific PC hardware
The correct way to manage Switch decryption keys is to dump them directly from your own hacked Nintendo Switch console. Obtaining keys from third-party websites or online forums is illegal and violates copyright laws. 🔑 Understanding Switch Prod Keys & Firmware
When setting up emulators like Ryujinx, or when managing custom firmware (CFW) like Atmosphere on your Nintendo Switch, your system requires decryption keys to read and launch games. What Are Prod Keys?
Prod.keys (Production Keys): System-wide cryptographic keys used by the Nintendo Switch to decrypt games, save files, and operating system components.
Title.keys: Game-specific keys required to decrypt specific game content.
Compatibility Rule: Your prod.keys must match or exceed the version of the firmware your game or emulator is running. For example, using Switch prod keys 14.1.2 means you can only decrypt games and updates released up to system version 14.1.2.
If you attempt to play a newer game that requires higher firmware capabilities (e.g., Firmware 19.0.0 or 20.0.0) while using version 14.1.2 keys, the emulator will fail to launch the game and show a decryption error. 🛠️ How to Safely Extract Keys from Your Console
To ensure legal compliance and avoid software piracy, you must extract prod.keys directly from your own Switch using a tool called Lockpick_RCM. Prerequisites
A Nintendo Switch console capable of booting into RCM (Recovery Mode) Atmosphere CFW. A high-quality MicroSD card.
The latest release of Lockpick_RCM (the payload file used to dump the keys). A payload injector or a PC connected via USB. Step-by-Step Key Dumping Guide
Prepare the SD Card: Download the latest Lockpick_RCM.bin file and place it in the bootloader/payloads/ folder on your Switch MicroSD card.
Boot into Hekate: Insert the MicroSD card into your Switch, connect your RCM jig, and boot your console into the Hekate custom bootloader menu.
Navigate to Payloads: In the Hekate main interface, tap on the Payloads button.
Launch Lockpick_RCM: Select Lockpick_RCM.bin from the payload list. Dump the Keys:
Use the Volume Buttons to navigate the on-screen menu and the Power Button to select.
Choose to dump keys from sysNAND or emuNAND depending on where your latest system version is installed.
Retrieve Your Files: Once the process finishes, power down your Switch, insert the MicroSD card into your PC, and navigate to the /switch/ folder on the root of your card. You will find your freshly dumped prod.keys and title.keys. 💻 Installing Keys in Your Emulator
Once you have dumped your prod.keys, you can apply them to your PC or mobile device to run your legally backed-up games. Setting Up Ryujinx Launch Ryujinx on your computer.
In the top navigation menu, go to File > Open Ryujinx Folder. Locate the subfolder named system.
Drag and drop your extracted prod.keys and title.keys directly into this folder. Restart the emulator. Setting Up Older Emulators / Forks Open the emulator application.
Navigate to the top menu and select File > Open Emulator Folder. Locate or create a folder named keys. Place your prod.keys file inside the folder. switch prod keys 14.1.2
Ensure you also match the emulator's firmware files with your console's dumped firmware for full compatibility. ⚠️ Troubleshooting Compatibility Errors Error Symptom Common Cause Recommended Fix "Keys not found" File placed in the wrong directory or renamed incorrectly.
Ensure the file is exactly named prod.keys (all lowercase) and resides directly in the keys or system folder. "Firmware parsing error"
Mismatch between the keys version and the installed firmware.
If you are using version 14.1.2 firmware, your prod.keys must also be version 14.1.2 or higher. To run newer games, update your Switch console's firmware and dump fresh keys. Game crashes on boot Game version requires newer decryption keys.
Newer games and game updates require higher firmware versions. Update your Switch firmware to the latest available release, then re-run Lockpick_RCM.
I’m unable to provide, draft, or help generate reports that include Nintendo Switch prod keys, as they are copyrighted material used to circumvent protection measures. Sharing or requesting them violates copyright laws and this policy.
However, I can help you draft a general informational report about Nintendo Switch security, key terminology (without the actual keys), or the role of prod keys in the console’s bootrom and titlekey system—provided it stays educational and does not facilitate piracy.
For users exploring the technical side of the Nintendo Switch ecosystem, "prod.keys" for firmware 14.1.2 are essential components for decrypting game data and system files. These keys are cryptographic identifiers that allow the Switch OS or various software tools to verify and run encrypted game content. What are Switch Prod Keys 14.1.2?
Decryption Password: Prod keys (product keys) act as the system's "passwords" to unlock encrypted game files.
Firmware Dependency: Each major Nintendo Switch firmware update includes new keys. Games released alongside or after firmware 14.1.2 often require the matching 14.1.2 keys to be decrypted and played.
System Identity: These keys are bound to individual hardware and tell the system that the software is being run in a legitimate environment. Why You Need Them
Emulation: High-performance emulators like Ryujinx and Suyu require these keys to read game ROMs (NSP or XCI files) on a PC.
Homebrew & Mods: While simple homebrew often doesn't need them, advanced tools for save management or custom firmware (CFW) configurations may require these keys to interact with system-level data. How to Obtain Prod Keys Legally
The only officially recognized way to obtain your keys is to dump them directly from your own physical Nintendo Switch console.
Modded Hardware: You must have a Switch capable of running homebrew (typically V1 unpatched consoles or those with a modchip).
Payload Tools: Use a tool like Lockpick_RCM via the Hekate bootloader.
Extraction: Boot into RCM mode, launch Lockpick_RCM, and choose to dump keys from your sysNAND. The resulting prod.keys file will be saved to the /switch/ folder on your SD card. Where to Use the Files
Once you have extracted your 14.1.2 keys, they must be placed in specific directories for software to recognize them:
It was a typical Monday morning for John, a software engineer at a large tech firm. As he sipped his coffee, he stared blankly at his computer screen, trying to shake off the weekend haze. His colleagues, scattered around the office, were slowly coming to life, chatting quietly among themselves.
John's task for the day was to deploy a new software update to the production environment. The update, version 14.1.2, had been thoroughly tested and was ready to go live. He logged into his workstation, a sleek and modern machine with a large monitor, and began to work his magic.
As he navigated through the deployment process, John encountered a peculiar error message. "Invalid prod key," it read. A prod key, short for production key, was a special code required to enable the software to run in production mode. Without it, the update would not deploy.
John tried to recall the prod key from memory, but it was nowhere to be found. He checked his notes, his email, and even the company's internal wiki, but the key remained elusive. Panic began to set in. Without the prod key, the deployment would be delayed, and his team would miss their deadline.
In a moment of desperation, John decided to reach out to his colleague, Emily, who was known for her exceptional problem-solving skills. He walked over to her desk, explained the situation, and asked for her help.
Emily listened attentively, her eyes narrowing as she processed the information. "Let me check the password vault," she said, referring to a secure storage system where sensitive information, including prod keys, was kept.
A few minutes later, Emily returned with a triumphant smile. "I found it!" she exclaimed, holding up a Post-it note with the prod key scribbled on it. John breathed a sigh of relief as Emily handed him the key.
With the prod key in hand, John was able to complete the deployment. The update, version 14.1.2, was successfully rolled out to production, and the team met their deadline. As John and Emily high-fived each other, the office erupted in cheers and applause.
From that day on, John made sure to store the prod key in a safe and accessible location, and Emily became his go-to person for all deployment-related emergencies. The switch to prod keys 14.1.2 had been a close call, but in the end, it had brought the team closer together.
Understanding Switch Prod Keys 14.1.2: A Comprehensive Guide for Firmware 14.1.2
Legal and Ethical Considerations
Important disclaimer: Prod.keys are copyrighted material and are tied to your specific console. Sharing or downloading prod.keys from the internet is a legal gray area and is explicitly prohibited by Nintendo’s Terms of Service. In many jurisdictions, circumventing DRM (Digital Rights Management) may violate copyright laws.
- Legal approach: Extract your own prod.keys from your personal, modded Switch using trusted homebrew tools (like Lockpick_RCM). This requires a hackable Switch (Erista units, unpatched) or a modchip.
- Illegal approach: Downloading pre-extracted prod.keys 14.1.2 from file-sharing sites. This exposes you to malware risks and potential legal action.
This guide assumes you already own a Nintendo Switch and have the legal right to create backups of your own system’s keys.
Conclusion
The keyword switch prod keys 14.1.2 represents a very specific need in the Switch homebrew and emulation community: matching cryptographic keys to firmware version 14.1.2. Whether you are a preservationist backing up your game library, a developer testing homebrew, or an emulation enthusiast, understanding how to legally obtain, verify, and use these keys is essential.
Remember:
- Always extract your own prod.keys from a console you own.
- Keep them safe and up-to-date with your system firmware.
- Respect intellectual property laws and use these keys only for legitimate purposes (e.g., backups, emulation of legally purchased games).
With the right approach, prod.keys become a powerful tool—not a legal liability. Now that you understand the role of version 14.1.2, you can confidently manage your Switch’s decryption keys and keep your emulation setup error-free.
This article is for educational purposes only. The author does not condone piracy or copyright infringement. Always follow applicable laws in your region.
- Musical piece (e.g., a melody, a short song, or a composition)?
- Literary piece (e.g., a short story, a poem, or a passage)?
- Art piece (e.g., a description of a visual artwork)?
Also, what does "switch prod keys 14.1.2" refer to? Is it a: It is important to clarify that prod
- Product key for a software or game?
- Code snippet or a technical reference?
Please provide more context or clarify your request, and I'll do my best to generate a piece for you!
file for firmware version is a vital cryptographic component used by the Nintendo Switch system to decrypt software, essentially acting as the digital "master key" for the console's operating system. In the context of the 14.1.2 firmware update—a minor "rebootless" update released by Nintendo to address system stability without requiring a full console restart—the keys ensure that games and system applications remain accessible while maintaining security. The Role of Keys in Emulation For users of emulators like
, these keys are the bridge between the encrypted game files (ROMs) and a playable experience. Decryption : Without the specific
matching the firmware version, the emulator cannot read the encrypted game data. Version Matching
: If you are trying to run a game that requires firmware 14.1.2 or higher, having the older keys will cause the emulator to fail to boot the game. Legal & Ethical Boundaries
: The legal consensus, spearheaded by Nintendo’s litigation against projects like Yuzu, argues that these keys are protected "circumvention" tools. To stay within legal bounds, users are expected to "dump" these keys from their own personally owned, hacked hardware rather than downloading them from third-party sites. Technical Context of 14.1.2
The 14.1.2 update was unique because it did not change the master key (KeyGeneration) from the previous 14.x versions. This meant that: Backward Compatibility
: Keys from 14.0.0 often remained functional for 14.1.2 content.
: The update focused on hidden system improvements and "bad words" list updates rather than a complete overhaul of the security architecture. Managing Keys Safely When setting up an environment that requires these keys: Required Files : You typically need both (system production keys) and sometimes title.keys
(specific game encryption keys), though many modern emulators can function with just the former. : On platforms like
, keys are placed in a specific "system" folder within the application directory to allow the software to authorize game launching. 14.1.2 prod.keys... - Yuzu Emulação Fãs - Facebook
2 prod. keys https://cdn.discordapp. com/attachments/823939573612281916/100015649 7235419166/prod. keys 14.1. 2 title. keys https: Yuzu Emulação Fãs
To use Nintendo Switch firmware on emulators like or the (now archived) , you need matching to decrypt your games. 1. How to Get the Keys
The only legal way to obtain these files is to dump them from your own hacked Nintendo Switch console using a tool called Lockpick_RCM
: Ensure your Switch is in RCM (Recovery Mode) and you have the latest version of Lockpick_RCM on your SD card. Lockpick_RCM via Hekate. Dump from SysNAND (or EmuNAND if that's what you use). Once finished, the keys will be saved to /switch/prod.keys on your SD card. 2. Where to Place the Keys Once you have the file, you need to put it in the emulator's system folder: For Ryujinx Open Ryujinx and go to Open Ryujinx Folder Navigate to the folder and paste Open yuzu and go to Open yuzu Folder Create a folder named (if it doesn't exist) and paste 3. Critical Matching Firmware Sync
must match or be newer than the firmware version of the game you are trying to play. For
, ensure your firmware files (installed separately in the emulator) are also version 14.1.2. Title Keys is the main requirement, some games also require a title.keys file, which is dumped during the same process in Lockpick_RCM
: Sharing or downloading these keys from third-party sites is considered copyright infringement. Always dump them from your own hardware. Are you setting this up for a Steam Deck Windows PC
for Nintendo Switch firmware 14.1.2, you must legally dump them from your own hardware using a tool called Lockpick_RCM
. Downloading these files from the internet is considered copyright infringement and is generally unsafe due to the risk of malware. Requirements Nintendo Switch (typically unpatched V1 models). to enter Recovery Mode. A microSD card. Lockpick_RCM (a specialized payload). Gadget GoGo How to Dump prod.keys Prepare the SD Card : Download the latest release of Lockpick_RCM.bin and place it in the /bootloader/payloads folder on your microSD card.
: Turn off your Switch. Slide the RCM Jig into the right Joy-Con rail and hold Volume Up + Power Launch Hekate
: Inject the Hekate payload from your PC or mobile device to boot the console into the Hekate menu. Run Lockpick_RCM In the Hekate menu, tap Lockpick_RCM.bin The console will reboot into the Lockpick interface.
Use the Volume buttons to navigate and the Power button to select. Dump from SysNAND (or EmuNAND if you use one).
The tool will process your system files and generate the keys. Locate the Files : Once finished, your keys (including title.keys ) will be saved to the folder on the root of your SD card. Why You Need These
These keys are unique to the Nintendo Switch security system. They are required by PC-based software like
to decrypt game files and system firmware so they can be read and emulated.
If you aren't sure if your console can do this, would you like to know how to check your serial number to see if it's patched?
To get the prod.keys for Nintendo Switch firmware 14.1.2, you generally have two main paths: dumping them from your own hardware or finding them through community-shared links. 1. How to Dump Your Own Keys (Recommended)
The most reliable and legal method is to extract the keys directly from your own modded Nintendo Switch console. This ensures complete compatibility with your specific firmware version.
Requirements: A modded Switch with Hekate and the Lockpick_RCM payload. Steps: Boot your Switch into RCM and launch Hekate. Navigate to Payloads and select Lockpick_RCM.bin.
Choose to dump from sysNAND or emuNAND (depending on where your firmware is installed).
Once finished, your prod.keys file will be saved to the /switch folder on the root of your SD card. 2. Finding Pre-Extracted Keys
If you cannot dump them yourself, you may find them through community-driven sites or forums, though these are not official sources.
Community Links: Some emulator-focused pages provide setup guides that include links to prod.keys and firmware files. Understanding Switch Prod Keys 14
Compatibility: Keys from version 14.1.2 are compatible with popular emulators like Ryujinx and the now-discontinued Yuzu. Note that while version 14.1.2 works, many newer games require more recent firmware and keys (e.g., v17.0.0+). 3. Where to Place the Files
Once you have the prod.keys file, you need to place it in the correct directory for your emulator to recognize it:
Yuzu: Go to File > Open Yuzu Folder and place the file in the /keys folder.
Ryujinx: Place the file in the %AppData%\Ryujinx\system or Emulation\bios\ryujinx\keys folder.
Eden Emulator: For mobile/other platforms, follow the Eden Emulator Setup Guide to ensure the "master key" is correctly recognized to prevent "keys not found" errors.
Warning: Be careful when downloading keys from unknown sites. If you run into software issues while managing these files, such as UI glitches, users on the Adobe Community often discuss similar technical troubleshooting for various tools.
Are you setting this up for a specific emulator like Ryujinx or Sudachi?
In the Nintendo Switch ecosystem, are essential proprietary encryption keys required to decrypt and run console software on external platforms. Version
refers to a specific firmware release (released around mid-2022) and the corresponding set of keys needed to run games compatible with that system version. Purpose and Function Decryption
: Prod.keys act as a "password" for the Switch's operating system. They allow emulators or third-party tools to decrypt game files (NSPs or XCIs) and system firmware. Emulation Requirement : Software like
cannot function without these keys, as they are legally prohibited from including Nintendo’s proprietary code in their downloads. Version Matching
: Generally, your prod.keys version should match or exceed the version of the firmware and the games you are trying to run. While 14.1.2 keys will run older games, newer titles may require keys from more recent firmware (e.g., 18.0.0+). Legal and Safety Context Official Extraction : The only strictly legal way to obtain these keys is to
them from your own physically owned, modded Nintendo Switch console. Tools like Lockpick_RCM
are typically used to extract these files directly from the console's hardware. Piracy Risks
: Downloading keys from third-party "key sites" is common in the community but technically constitutes a copyright violation. Furthermore, many sites offering "latest prod keys" can be deceptive, providing older versions or potentially malicious files. Title Keys vs. Prod Keys : While prod.keys are universal to the console's firmware, title.keys
are specific to individual games. Most modern emulators can generate necessary title keys automatically if a valid prod.keys file is present. 14.1.2 prod.keys... - Yuzu Emulação Fãs - Facebook
2 prod. keys https://cdn.discordapp. com/attachments/823939573612281916/100015649 7235419166/prod. keys 14.1. 2 title. keys https: Yuzu Emulação Fãs
Не хватает ключей в файле Prod.key? : r/SwitchPirates
In the context of Nintendo Switch homebrew and emulation, prod.keys (production keys) are essential cryptographic files used to decrypt game data and firmware. Version 14.1.2 refers to the specific set of keys required to match the Nintendo Switch system firmware 14.1.2 released in mid-2022. Overview of Prod Keys 14.1.2
Purpose: These keys act as "digital handshakes." Without them, emulators like Yuzu or Ryujinx cannot recognize or launch games, and tools like Lockpick_RCM cannot dump system files.
Security Context: Each firmware update often introduces new "master keys." Firmware 14.1.2 was a minor stability update, but it still required the corresponding key set for full compatibility with newer software titles released during that period. How to Acquire Them
According to community guides on Reddit's SwitchPirates, the only legal way to obtain these keys is by extracting them from your own physical Nintendo Switch console.
Preparation: You must have a "hackable" Switch running custom firmware (CFW) like Atmosphere. Tool: Use a payload called Lockpick_RCM. Process: Boot the console into RCM (Recovery Mode).
Inject the Lockpick_RCM payload via a tool like TegraRcmGUI or Hekate. Select the option to dump keys from sysNAND.
Location: Once the process is complete, the prod.keys file is saved to the /switch/ folder on your SD card. Legal and Safety Note
Downloading prod.keys from third-party websites is considered copyright infringement and poses a security risk, as these files can be bundled with malware. Always use your own hardware to generate these files to ensure they are clean and compatible with your specific backups.
It’s important to clarify that “Switch prod keys” (short for product keys) are cryptographic files used by PC-based emulators like Yuzu or Ryujinx to decrypt and run Nintendo Switch games and system files. These keys are proprietary to Nintendo and are not officially distributed — they must be dumped from a user’s own physical Nintendo Switch console.
The specific version number — 14.1.2 — refers to a particular Nintendo Switch system firmware version. Each firmware update changes some cryptographic keys, especially the Title Keys (for games) and Prod.keys (a bundle containing master keys, title keys, etc.). Emulators require the corresponding prod.keys file that matches the firmware version of the game or system dump you are trying to run.
If you see a request or mention of “switch prod keys 14.1.2,” it typically means:
- The user has a game or NAND dump that requires the key set from firmware 14.1.2.
- Without these keys, the emulator cannot decrypt the game’s code or assets.
Key technical points:
- Master Keys — Rotate with each major firmware; 14.1.2 introduced a new master key (often called
master_key_0aor similar depending on the key generation numbering scheme used by the community). - Where they come from — Legally, they are extracted from a hacked Switch (via tools like Lockpick_RCM) from a console that was updated to firmware 14.1.2.
- Legal & ethical note — Distributing prod.keys files is copyright infringement, as they are protected encryption data. Emulation communities strictly advise users to dump their own keys.
In practice:
If you need prod.keys for firmware 14.1.2, you must have access to a Nintendo Switch that is:
- Updated to system version 14.1.2 (or higher, but keys are version-specific).
- Capable of running custom firmware (e.g., Atmosphere).
- Use a key dumping homebrew tool to generate your own prod.keys file.
Warning:
Downloading prod.keys from the internet is illegal in many jurisdictions and exposes you to potentially malicious files (malware, stolen credentials). Moreover, large emulation projects have been shut down or sued due to promoting or hosting such keys.
In summary: “Switch prod keys 14.1.2” refers to the set of decryption keys needed for emulators to support content from Nintendo Switch firmware version 14.1.2. You must extract them from your own console — never download them.
Understanding Switch Prod Keys 14.1.2: Purpose, Usage, and Legal Context
In the context of Nintendo Switch system software and custom firmware (CFW) like Atmosphere, "prod.keys" (short for product keys) are a critical file that enables the decryption of official Nintendo software. The version designation 14.1.2 refers to a specific firmware version of the Nintendo Switch operating system.
How Are Prod Keys Obtained?
Legitimately, prod.keys are dumped directly from a user’s own Nintendo Switch console using specialized homebrew tools such as Lockpick_RCM or kezplez-nx. The process requires the console to be already running a custom firmware (like Atmosphere) via a hardware vulnerability (for unpatched Erista units) or a modchip (for patched/Mariko units).
Crucially: You should never download prod.keys from public websites. Not only is downloading keys for a console you do not own a potential violation of copyright laws in many jurisdictions (as keys can be considered proprietary protection measures under the DMCA), but it also exposes you to malware risks.
Technical design
- API endpoints (example resources)
- POST /prod-keys/rotations — create rotation plan
- GET /prod-keys/rotations/id — status
- POST /prod-keys/rotations/id/promote — promote staged key
- POST /prod-keys/rotations/id/rollback — rollback
- GET /prod-keys/keys — list keys and states
- Key states: pending, staged, active, legacy, retired
- Rollout strategies:
- Canary: promote on subset of instances; monitor N minutes then continue.
- Phased: percentage-based batches.
- Immediate: all instances.
- Service-side handling:
- Support dual-key mode: accept primary and secondary concurrently for verification.
- Graceful swap: allow existing sessions to finish, new sessions use promoted key.
- Hot-reload keys from KMS with minimal restarts.
- Validation checks:
- Liveness & readiness probes
- TLS handshake success rate threshold (e.g., <0.1% errors)
- JWT/signature verification on a sample of requests
- End-to-end smoke tests
- Observability:
- Dashboard showing rotation progress, per-service health, error rates.
- Audit logs with actor, timestamp, rotation id, actions.
- Alerts for failed validations or rollback triggers.
- Security:
- RBAC: only authorized roles can initiate/promote/rollback.
- MFA and approval workflow for high-impact rotations.
- All secrets handled via KMS/HSM; no plaintext in logs.
- Wipe old keys per retention policy; support export for compliance.
- Testing:
- Unit tests, integration tests against KMS emulator.
- Chaos tests: simulate failure during promotion/rollback.
- Canary rehearsals in staging.