Why not have this instead of a key rotation:
Have 2 keys in a service: Master and Slave
Service listens for slave's events. Deletes them, and signs the same event with the Master key.
If the delegated key is compromised, simply swap it with a new one in the service.
