HMAC keys by kid: the current secret's, and the previous one's to verify only.
The kid new cookies are signed under: the current secret's.
HMAC keys by kid: the current secret's, and the previous one's to verify only.