Copy/migrate archives/history with a new key?

[creed-january-twig@duck.com]

I *have to* change my tarsnap key (or rather, stop using the old key).

I see this https://www.tarsnap.com/tips.html#copy-archive as well but I don’t really understand what it is and what it does - but I don’t see a key mentioned in the command so I guess not like “restic copy”.

This https://www.tarsnap.com/man-tarsnap-recrypt.1.html seems to be the only way, right? 

Also, the original/existing key was not *passworded*, can I generate the new key as ‘--passphrased’ and then proceed with the recrypt? I am asking because I believe to re-encrypt, ‘tarsnap-keyregen’ has to be used and the key is derived from the old key.

This also raised the question - does it render the old key useless after the re-encryption is done, or both keys have access now?