New section should be added to the "Data at Rest Encryption":
System key rotation.
In 5.7 and < 8.0.14 it is possible to rotate encryption key used by PS by calling :
This will create a new version of binlog encryption key in keyring. This version will be used to encrypt next binlog file.