Correct. You would create #2 events for the past content.
To revoke access, we can make the events replaceable so that at any point, you can rotate the secret. You will need to update #1 and all #2 events, though. Those who didn't get the update cannot decrypt the content anymore.
Totally worth doing in my mind.