Defense-in-depth tripwire for the atomic key_identity/1 snapshot (the transition analogue of RacingKeyIdentityHandle). key_identity/1 returns a consistent {key_id, pub_a} snapshot, then flips internal state so sign/2 signs with priv_b (a simulated post-snapshot rotation). The atomic snapshot means key_id+public_key cannot drift apart; the verify_signature guard catches the sign/2-vs-snapshot mismatch -> :signing_failed.

The handle term is an Agent pid whose state is %{key_id:, pub_a:, priv_a:, priv_b:, rotated:}.