Why can't they rotate ? having root ssh keys on the device doesn't imply the certs don't rotate.