Why no broker holds a key
A design that issues each broker a private key cannot take it back. A key can be copied, and a copy stays readable long after the person holding it has left. Withdrawing access then means re-encrypting the whole renewal book, which is slow, can be interrupted and restarted repeatedly, and leaves the departed broker reading the book throughout while the firm believes otherwise.
How access works instead
No key is stored anywhere: not on a laptop, not in a database. A key is calculated at the moment it is used, by several separate services acting together, and no single one of them can calculate it alone. Access is a row in a register. Withdrawing it is one small write, it takes effect on the next request, and nothing can hold it up.
What the book records
Opening a renewal record now leaves a trace. Without one there is no way to tell an ordinary morning at the desk from the whole book being copied, and no way to answer the question afterwards.
The limit, stated
Withdrawal closes everything in front of a departed broker. It does not reach records nobody has opened since they left, which close as the desk edits them in the ordinary course of work or when a full re-encryption pass is run deliberately.
How this design was chosen
Three earlier designs were put through adversarial review and rejected before the fourth was accepted. Rejecting a design on paper costs a fraction of correcting one that is already holding a book.