apparently key rotation doesn't mean actually updating the keys
- removed all non-admin keys from ssh and sops - rotated sops keys - regenerated secrets