some secrets in production have not changed in a year. nothing tells you that
relic rotation set -e production --every 90 starts a clock from the last time the value changed. overdue ones show up in the cli, the tui, and the dashboard. the value is never decrypted to check