Actually there is a way to update the encryption keys programmatically, without ssh access to AEM instances. The approach: 1. Upload the key in AEMfor example, to  /content/dam/crypto/hmac 2. Read the key bytesResource resource = resourceResolver.getResource("/content/dam/crypto/hmac");byte[] key = ...