Hi, Pawel. I believe the author of this feautre said before that even if key has expired, it shouldn't cause immediate trouble. But I'll ask him to review that possibility anyway. Thanks again for letting us know, your contribution is much appreciated.

Hi, Pawel. According to the dev team, it's not an issue, as in case when the key regeneration is disabled, it becomes server administrator's duty to maintain and renew the keyset using whatever means they seem suitable; they also can set whatever expiration time they need during this process. There are doc pages describing the procedure, and we also have prepared a console script that automates this process. Closing this ticket for now.

The only issue I can see then is initial keys are valid 2 days as hard-coded in setup. If you do not believe this is an issue then ok.