Add a command for revoking all rotation keys

[johnbillion]

Need to think carefully about use cases.

There could be a use for:

• Revoking all rotation keys except the one being used to sign the revocation request
• Creating a new rotation key and then using it to revoke all existing ones