Generating and distributing a secret without trusting the source I have multiple entities (servers) that all share a private secret already.
Those servers need a rotating secret (TTL a few hours). All servers must have the same set of secrets at all times.
I have another server (command &amp; control) with a communication channel to all my clients.
I want the command &amp; control to handle the generating and rotating of the temporary secrets.
I also don't want the command &amp; control to ever know the temporary secret.
So basically:

command &amp; control generates a random blob
command &amp; control distributes the blob to clients
clients use their shared secret to reduce the blob into a common secret (using I presume a pseudo-random cryptographic function)
the final secret needs to be ~80 bytes

What would be the best practices to do this?
You'd use a KBKDF on the clients, using the earlier secret as Input Keying Material (IKM) using the random as salt or Info input. KDF's generally have an output size parameter as well.
Currently HKDF is considered a good KDF, and if you use the full function it supports a salt.
Basically you would be implementing a so-called ratchet, where each key depends on the previous one, but doesn't provide any information about the previous keying material.