Rotate secret database encryption key

The database is encrypted using the secret key held in the configuration directory.  However there is no way to rotate this key if we want to change it - such as after a Systems Administrator leaves the company.

It would be useful to have a utility that

* Generates a new secret key

* Decrypts the database and re-encrypts with the new secret key

This would allow us to rotate the key on a regular basis (say, yearly) to protect against loss of the master key.

Similarly, it would be good for individual users to be able to change their own private salt key and automatically re-key their existing records to this new key.