Using the account identifier in the record and and LE mapping the identifier to a public key internally enables key rotario without touching the record again.