I have not rolled over my keys in a long time, because the required process scares me.   Maybe the problem is lack of documentation, since the help topic for "Email Signing" is short on details.  (A help content search for "DKIM" produces a list of possibilities, none of which links directly to "Email Signing".)

The apparent process, if I understand it:

While this key is being rolled over, outbound messages are not signed.  This is a problem.

If the new key is activated as soon as SmarterMail allows, some corners of the Internet may not be able to validate new messages because the key propagation has not reached their DNS provider.  This is also a problem.

We should be able to configure a second key without disabling the first one, then activate the new key hours or days later, after propagation delay has been taken into account.