That doesn't even make sense. People use environment variables to store things like API keys for third-party services. How do you expect them to magically rotate or decommission those keys?
Trigger.dev wouldn't rotate customer BYOK. What I was saying is they disable customer use of their service until rotation occurs or is confirmed by the customer.
That doesn't really help anything and just makes the exploit impact even worse since it would be effectively a denial of service