My question really is: how does an enterprise (a small ~150-employee company) manage the passphrases and encryption keys used at the time of encrypting a large volume of data, when such encrypted data is supposed to be in "cold storage", and available, for decades?
But this "underlying" question is perhaps too open-ended for this site, so I hope that answers to my "official" question in the title will point in the right direction.
The scenario alluded to above presents a serious conflict between the common practice of changing passphrases frequently, and the fact that the encrypted data is voluminous enough that could not be re-encrypted using a different key without a great deal of effort.