Manages a rotating collection of DKIM mail signing keys, advertising them via the DNS, and revealing the private halves of old keys so as to avoid making email non-repudiable.