GetOrCreateSnapshot either returns the existing latest snapshot, or uses whatever the most recent snapshot is to generate the next one, only updating the expiry time and version. Note that this function does not write generated snapshots to the underlying data store, and will either return the latest snapshot time or nil as the time modified
GetOrCreateSnapshotKey either creates a new snapshot key, or returns the existing one. Only the PublicKey is returned. The private part is held by the CryptoService.
RotateSnapshotKey attempts to rotate a snapshot key in the signer, but might be rate-limited by the signer