Goal: fresh signing keys with no unverified-event gap.
Step 1. Generate the new signing key in Settings > Mail Settings > Event Notification.
Step 2. Deploy the receiver to accept signatures from either the old or the new key. Try the new key first, fall back to the old; log which key verified each event.
Step 3. Wait until events are consistently verifying against the new key. That proves SendGrid has fully cut over.
Step 4. Remove the old key from the receiver config, then delete it in the console.
Verify: events verify against the new key only, and the verification-failure log is empty. Pitfall: deleting the old key before SendGrid finishes cutting over drops real events as unverified.