An application uses storage account keys. Operations needs to rotate credentials with minimal interruption. What is the supported general approach?

1. Add a cost tag and leave keys unchanged
2. Switch clients to the alternate key, regenerate the unused key, and rotate deliberately
3. Rename the container to refresh both keys
4. Regenerate both keys simultaneously before changing clients