How to edit did:plc rotation keys

[rekmarks]

I have migrated my Bluesky handle rekmarks.com to my own PDS. I am trying to replace one of its rotation keys. Here's what I observe:

1. I check the rotation keys returned by com.atproto.identity.getRecommendedDidCredentials
2. I sign and then submit a PLC operation via com.atproto.identity.submitPlcOperation to update the rotation keys
3. On the first attempt, I didn't include the server's rotation key and hit this error
4. On the second attempt, I included the server's rotation key, and the operation ostensibly succeeded. However, com.atproto.identity.getRecommendedDidCredentials returns the same result as in step 1 above.

Questions:

1. How can I check which rotation keys I have added to my account?
2. How can I remove a rotation key that I have added?
3. What is "the server's rotation" key, and why is com.atproto.identity.getRecommendedDidCredentials returning the same result?

[rekmarks]

Aha: looking at the plc audit log for rekmarks.com, it looks like:

• There have been two rotation keys since I migrated the handle
• The second key has been the same, and this is also the key returned by com.atproto.identity.getRecommendedDidCredentials
• The first key has changed, most recently January 14 (today) UTC

Are we then in the following situation?

• The first key in the rotationKeys array is the key I have added manually via PLC ops
• The second key is the server's rotation key
  • This is a key stored on my PDS that it uses to sign its plc operations?
• I have successfully replaced one of my rotation keys

[snarfed]

Looks like you've been busy! https://plc.directory/did:plc:kafdwhssooa65puiidhv6sy4/log/audit is the right place to look, it shows three changes over the last couple hours. If I read it right, the first of those three (2025-01-13T00:51:15.024Z) replaced both rotation keys, and the third (2025-01-14T02:13:23.044Z) replaced the first.

If you're interested in this stuff, you may want to dig into the PLC directory itself, https://github.com/did-method-plc/did-method-plc, how to do operations against it directly, and how the PDS API calls map to those operations. (Personally I'm familiar with PLC operations, but not with the PDS's wrapper API calls.)

[rekmarks]

To more explicitly answer my own questions:

How can I check which rotation keys I have added to my account?

https://plc.directory/<did>/log/audit

See rotationKeys. Entries in ascending order by timestamp.

How can I remove a rotation key that I have added?

Submit a PLC operation that doesn't include it in the rotationKeys array. Your PDS's key must always be included.

What is "the server's rotation" key, and why is com.atproto.identity.getRecommendedDidCredentials returning the same result?

The server has a key listed in /pds/pds.env. This is that key. getRecommendedDidCredentials only returns this key for whatever reason. I don't know how to get the other key identifiers from the TypeScript API, but the /log/audit endpoint above has them.