Keys are replaced once their crypto-period expires; the application vendor or key owner defines that period from industry practice such as NIST SP 800-57, either by elapsed time or by the amount of ciphertext produced.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.