A transit key is rotated to a new version. What normally happens to existing ciphertext when older key versions remain permitted?

1. It is silently rewritten in each external database
2. It becomes plaintext in the transit configuration
3. It can still be decrypted using the retained corresponding key version
4. It is automatically erased from every client database