    @Test
    void testFullRotation() {

        // Fills the keystore
        rotation.rotate();
        Set<String> expiredIds = entries().all().stream().map(KeyAlias::getAlias).collect(Collectors.toSet());
        assertThat(expiredIds).hasSize(2 * NUM_VALID);
        when(timeSource.instant()).thenReturn(BASE_TIME.plus(VALIDITY_DT).plusSeconds(1));

        when(access.read()).thenReturn(getLastPersistedKeystore());
        rotation.rotate();

        Set<String> legacyIds = entries().all().stream()
                .map(KeyAlias::getAlias)
                .filter(it -> !expiredIds.contains(it))
                .collect(Collectors.toSet());
        assertThat(legacyIds).hasSize(2 * NUM_VALID);

        when(timeSource.instant()).thenReturn(BASE_TIME.plus(LEGACY_DT).plusSeconds(1));
        when(access.read()).thenReturn(getLastPersistedKeystore());
        rotation.rotate();

        assertThat(entries().all()).hasSize(4 * NUM_VALID); // VALID + LEGACY
        assertThat(entries().privateKeys().toCollection()).hasSize(2 * NUM_VALID);
        assertThat(entries().secretKeys().toCollection()).hasSize(2 * NUM_VALID);
        assertThat(state(SECRET, VALID)).hasSize(NUM_VALID);
        assertThat(state(ENCRYPTING, VALID)).hasSize(NUM_VALID);
        assertThat(state(SECRET, LEGACY)).hasSize(NUM_VALID);
        assertThat(state(ENCRYPTING, LEGACY)).hasSize(NUM_VALID);
        assertThat(state(SECRET, EXPIRED)).hasSize(0);
        assertThat(state(ENCRYPTING, EXPIRED)).hasSize(0);

        assertThat(entries().all().stream().map(KeyAlias::getAlias).collect(Collectors.toSet()))
                .doesNotContainAnyElementsOf(expiredIds);
        assertThat(entries().all().stream().map(KeyAlias::getAlias).collect(Collectors.toSet()))
                .containsAll(legacyIds);
    }