Enterprises are leaving high-privilege keys unchanged for months or years at a time