Verifies a detached-JWS (oldJws) under oldKid—
either the header's kid or sourceKidOverride
if the header lacks a kid—and immediately signs the same payload with
newKid. Streams only the new detached-JWS JSON back.


Supports all key type combinations:

• SIMPLE → SIMPLE (single signature → single signature)

• SIMPLE → COMPOSITE (single signature → multiple signatures)

• COMPOSITE → COMPOSITE (multiple signatures → multiple signatures)

• COMPOSITE → SIMPLE (multiple signatures → single signature)