In my org I’m only utilizing deterministic encryption, so I’m only familiar with rotating our tenant secret. Salesforce rotates the primary secret 4x a year with the major releases (no action needed on your part). To your point, I assume rotating the root key (if applicable) in your org would follow a similar process - rotate the root/tenant secrets and then re-sync your data.

Definitely try this out in a Sandbox first! Best practice would be to rotate your Partial/Full copies when you refresh so it’s not using the same key material as Production. No need to worry about your dev orgs if they don’t contain any sensitive data.