Things to build:
key regeneration ceremony
The current software does not allow for a new encryption key to be issued. There should be a process to issuing this which includes migrating the existing data.enc file. It should also have a feature to remove all backups that use the previous encryption key.
command to erase the key
In Signal, you can set the encryption key, but you cannot erase the key. This would be a useful command to issue should you have to surrender your phone for repairs etc.