1

Correct. You would create #2 events for the past content. To revoke access, we can make the events replaceable so that at any point, you can rotate the secret. You will need to update #1 and all #2 events, though. Those who didn't get the update cannot decrypt