Number of days before expiration when replacement credentials should be generated
A notification is sent first; production credentials are never revoked until every target confirms receipt.
Require owner confirmation before revoking the previous production credential