Short-lived leaf bounds the blast radius of a key compromise. Doc notes the renewal caveat: re-sign is activation-only today, so a hive that stays up >30 days without a rebuild would need a periodic re-sign timer to avoid leaf expiry (follow-up).