A single key per person and for life is too core to how the protocol works. Everything is built on top of that. It's the core of the core of the core. Rotate-able subkeys are a non-starter.

All you've got is a bunker-esque solution or a protocol fork.