When Cloud KMS rotates a symmetric key, it: Creates a new key version with fresh key material Sets the new version as the primary version Keeps all previous versions in the ENABLED state New encrypt ...