Mint a fresh bearer grant key for the provider and retire the previous one. The new key + binding are pushed to relays and daemons before the old grant is revoked (grace-safe). Like create, the new grant key is returned exactly once and is never retrievable afterward.