Third party clients include e.g. the WireGuard driver in the Linux kernel. It's definitely not the network driver's job to mitigate an attack against one specific commercial service.

> what is stopping third parties from doing key rotations

Knowing to do so, primarily.