Clarification of when data protection keys are read

[ADringer]

Hi all, just wanted to know when data protection keys are read when persistence has been configured. Does it only read on startup and write when it needs to? Does it ever read again during the lifetime of the app in the case of the persistence store has been updated externally?

Thanks