The question is unanswered I see.
Using AKV we don't need anymore certificate but the question to rotate is still alive.
In Azure Key Vault you can create a new version of the key and re-encrypt the DEK.
It works but then you cannot re-encrypt the old backup anymore and this is a problem because you cannot restore them.
You have to create a new key, a new credential and a new login and preserve the oldest in order to restore the bk.
Regards,
Graziano.