How does the manual shared secret rollover work?