Hardware key signing I think has been done. Key rotation is tricky, I think basically you just need to get a new key and advertise that you're on that and the other is compromised.