Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the destructiveHint/non-idempotent annotations: the old key is revoked immediately and later calls with it fail, the new key is shown only once, and identity/history/credits/settings are preserved. It also adds an operational instruction ('Store the new key before you do anything else') that prevents a real failure mode.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.