--zone <zone> /| --policy <policy> [--keytype <type>] | --all
"keytype" specifies the a single type of key to roll (both are rolled if nothing is specified) . After running, the enforcer will be woken up so that the signer can be sent the new information.
If the policy that the zone is on specifies that keys are shared then all zones on that policy will be rolled. A backup of the sqlite DB file is made (if appropriate).
From 1.4.1 either the keytype must be specified or the '–all' option is required for this command. This is to avoid the possibility of rolling more keys than intended by accidentally forgetting to specify a key type.
ods-ksmutil key purge
--zone <zone> /| --policy <policy> aka -z /| -p
ods-ksmutil key generate