...
Each time the seckeygen utility runs, it generates a new iteration of the key and updates the key version number (and a date/time in a comment). It also maintains a limited number of earlier keys (defaulting to 330, set with the --count option), which should be set based on how often you run the script and how long earlier data used by clients needs to be readable. Any data written with the DataSealer is always encrypted with the latest version of the key, but any data encrypted with an older key can still be read as long as the key remains accessible.
...