This read-create timestamp marks when the router will stop accepting inbound packets authenticated with this key, closing the acceptance window after a rotation overlap period ends. An administrator sets it to fully retire an old key once all peers have confirmed switching to a replacement, tightening security by no longer trusting the expired secret. For example, after confirming every peer has moved to the new key, an admin sets this OID to the current time to immediately stop the router from accepting any more packets signed with the old one.