GetOrCreateSnapshot either returns the existing latest snapshot, or uses whatever the most recent snapshot is to generate the next one, only updating the expiry time and version.

GetOrCreateSnapshotKey either creates a new snapshot key, or returns the existing one.

RotateSnapshotKey attempts to rotate a snapshot key in the signer, but might be rate-limited by the signer.