Production credential rotation and revocation policy for deployment targets

Replacement credentials are distributed before the current credential expires. Revocation begins only after every target confirms receipt.