@neilh93
Great.
Yes I use a similar thing for my commercial product. But remember that nodes may miss (due to RF issues, power) the "key change" message and still use the old one.
What I did was to clone the existing device on the server backend but with the new keys. Then when a transmission arrives on the new device (which means the node has updated the keys) the old device is deleted.
If the next transmission still arrives on the old device it means the node has not picked it up so a new key change message is scheduled for retransmission - this is repeated until it's finally picked up.