Best practice approach for environment specific keys
So, I reached out to one of the authors of key and the lockr service to get some help.
What I learned is, if using the key module without lockr, you can change the value of the key while keeping its machine name the same.
But, if using lockr (and you should be using lockr) it will create and swap keys for you based on your environment automatically. So, your encryption profile will automatically be kept up to date. Awesome stuff.
Hope this is helpful to others, the docs are here; https://docs.lockr.io/#separate-environments