Hey, I have a question with rotating secrets: we use oidc flows and the kratos stores encrypted data related to the providers linked to the identity. I’m guessing it’s the initial access tokens. Can we ever get rid of the secrets that were used for this encryption (at linking)? As I read the docs, it’s possible to add new keys, but we still need to keep the old ones to decrypt old data. Is re-encryption happening somewhere in the background?