Preview: the CLI and API are not released yet.
Euthyne
CLI reference

euthyne keys

Manage the device key.

Coming soon

Planned command. Not released yet.
euthyne keys rotate

rotate creates a new device key. The old key signs the new one, a key event is written to the log, and Euthyne issues a new credential for the new key.

Revoking a key is done from the dashboard. Revocation is logged at a given log index. Later receipts signed with that key are rejected and fail verification. Earlier receipts stay valid, with a note.