How key rotation is handled, or even supported, highly depends on the DID method in question. Examples of DID methods are
did:web (served from a webserver),
did:jwk (JWK encoded as DID) and
did:btc (DIDs anchored on the Bitcoin blockchain). A method specifies how to create, read and update a DID document. Meaning there isn't a single way in how to create and update DID documents, it's highly dependent on the DID method.
Given that, key rotation is "just" a matter of adding a new key to the DID document (given it can contain multiple keys) and removing the old.
That is, given the DID methods actually supports multiple keys. Most do, but simple methods like
did:jwk encode a single JWK into a key and don't support updates or multiple keys. And if the DID method support updates (I think most do), they don't necessarily allow reading previous versions. This could mean that after key rotation, old versions containing the old key aren't available anymore, immediately invalidating signatures created before rotation.
For example, Web DIDs (
did:web) can be updated (change the file) and support an arbitrary number of keys in it, but the DID method doesn't support DID document history.
A DID document doesn't need to be created from a key pair, this again depends on the DID method. For example, a Web DID (e.g.
did:web:example.com) is "created" as soon the DID document is served from
https://example.com/.well-known/did.json. It doesn't even need to contain a key!