Only invalidate patched cert chains when keybox changes. Generated key material is independent and survives rotation.