We do need to expire cryptographic keys eventually, there is no sane alternative to this. Now, note that "regularly online" here could mean once every X years depending on how the system is configured.