RotateNodeCredentials accepts a request containing an encrypted fetch node credentials request and expects to be able to decrypt it via the key ID from the contained value.

RotateRootCertificates generates roots: private keys and self-signed CA root certificates.