I ran into this and even though it says 'Insufficient Privileges' when exporting the JKS file, it turned out that it was only giving that error because the password was not alphanumeric. I had to add both letters and numbers into the password before it worked successfully.
I would only ever do No. 2 because every single audit history record is then going to be against the new user even though the old user did it. Yep, it's more of a PITA, but if you are in a heavily regulated industry you are going to need a clean audit trail, and you should have that no matter the size of your org.