Key rotation

[link2xt]

I don't see it anywhere in the documentation. Does acmetool rotate the keys ever or does it generate a single key and then renews certificates for the same key forever?

[mnalis]

As far as I can tell, it generates new private key on every certificate renewal (i.e. every 2 months)

[link2xt]

Account key in /var/lib/acme/accounts/acme-v02.api.letsencrypt.org%2fdirectory/*/privkey seems to be never rotated.
/var/lib/acme/live/<domain>/privkey points to a recently created key in /var/lib/acme/keys/ but old keys in /var/lib/acme/keys/ seem to be never removed.