HSM key rotation creates a new version which may cause a distributed race condition between Event Hub consumer and producer. By providing a specific exception type for decrypt failure due to invalid key other than the one further below, allows me fallback to previous version and retry. However, at this time I'm relying in the error message below, which is a weak approach since any chance in the exception message will break my retry logic.

Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Unable to decrypt specified value with this key