Issue 1 : You mention password encryption. Firstly why are passwords rather than salted hashes of passwords used? As for key rotation/expiration, I've seen (and coded for) policies like that. The longer a key is in use (and the more times it is used) the higher the risk it may become comprised/discovered. Some systems, for example Windows DPAPI automatically expire keys, SSL certificates have expiration dates after which a lot of systems will not use them to encrypt new data and so on.
Issue 2: Yes, that's bad. Incredibly bad.
The PCI compliance audit specs for the PAN state "Strong cryptography, such as Triple-DES 128-bit or AES 256-bit, with associated key management processes and procedures"
Rotation could be argued to be part of the key management process, and storing the key securely away from the data definitely is part a key management process.
Section 3.6.4 of the audit specs go further and state
Periodic key changes
- As deemed necessary and recommended by the associated application (for example, re-keying);
- preferably automatically At least annually
