This is a Multi-part question....
If I wanted to utilize the Salesforce KMS. Do I just need to hit the Generate Tenant Secret button on both the Data In Salesforce and Data in Salesforce (deterministic)? Then Salesforce KMS generates the key in the background automatically? With no more input from me?
Let's say in a year, I need to generate new keys....Do I just hit Generate Tenant Secret again, and then use the "sync" feature, to encrypt all my data with the new key? Then, in another year, just do the same process, and the first key can fall off? Is there any steps I should do to back anything up during this key rotation process?
Do Most people just "export" the key, just to save it in a different place for backup purposes? When I export, does anything happen to the key stored within Salesforce?