In DKE, keys exist in several versions. When saving a DKE protected document the latest version is used. Since the version ID is stored with the document, documents protected with older versions can still be opened.
In Utimaco DKE access permissions can be managed for each version individually, but the commands also allow to change permissions for all versions of a key simultaneously. Currently, its only possible to set permissions for users individually, where users are identified by their email address in Azure AD.