Hacker News Reader

Alternatively you could just encrypt the already encrypted data with the new key.

Wouldn't that require you to retain all compromised keys, and daisy chain the encryption operations?