@CanIgnoreReturnValue
  public synchronized KeysetManager rotate(com.google.crypto.tink.proto.KeyTemplate keyTemplate)
      throws GeneralSecurityException {
    addNewKey(keyTemplate, true);
    return this;
  }
Generates and adds a fresh key generated using {@code keyTemplate}, and sets the new key as the
primary key.

@throws GeneralSecurityException if cannot find any {@link KeyManager} that can handle {@code
    keyTemplate}
java_src/src/main/java/com/google/crypto/tink/KeysetManager.java