Ory Kratos needs secrets that are used for encrypting, decrypting, generating and validating signatures, and other cryptographic tasks.
These secrets must have high entropy (>= 256 bit). It is also a good idea to rotate the keys every now and then. Assuming you have the following secrets configured
and want to rotate these secrets, you would add the new secrets to the top of the list and keep the old secrets around. This allows the system to verify and decrypt things that have been signed/encrypted with the old secret, while generating new signatures and encrypting new things using the new secret: