MACsec: Pre-shared key (PSK) chains

You implement the hitless rollover keychain feature for increased security and to prevent session drops when the connectivity association key (CAK) configuration changes. In this implementation, a keychain that has multiple security keys, key names, and start times is used. Each key in the keychain has a unique start time. At the next key's start time, a rollover occurs from the current key to the next key, and the next key becomes the current key. With the implementation of the hitless rollover keychain feature, the MACsec Key Agreement (MKA) protocol establishes MACsec sessions successfully without any session drop when the CAK configuration changes.