What is the least risky way to rotate WireGuard peer keys on devices that may stay offline?

Replacing a peer public key is simple when both ends can change together. It is less clear when laptops or small remote devices may be offline for weeks and the old key must eventually stop working. WireGuard identifies a peer by one public key, so there is no obvious overlap window for two keys on the same peer entry.

A staged approach could add a temporary second peer with a new key and a unique transition address, let the device reconnect and confirm traffic on the new identity, then remove the old peer after a deadline. That creates extra AllowedIPs and routing state, and careless overlap could make peer selection ambiguous. Reissuing a full configuration through another management channel is simpler but leaves recovery dependent on that channel.

How do you handle this in practice without locking out intermittently connected devices? Which endpoint, AllowedIPs, keepalive, and rollback checks are essential, and how do you prove the old key is no longer accepted after the transition?

https://redd.it/1wm1mla
@r_wireguard