No, they are not until all clients have obtained new tickets.

If you immediately remove a key upon refresh, all clients that have
acquire a ticket against the old key and have it still valid (validity
depends on local KDC configuration but may be 24h or even days) they
will just fail to connect to a service if said service does not have
access to the previous key.

The problem is compounded by the fact you have no way to tell the
clients that you got new keys, so client simply error out. The user is
required to do destroy his credentials and obtain new ones and then go
fetch new tickets for the service.

Old kvnos can be rotated away once the Realm specific limits on
credential expiration are reached so that it is technically impossible
to have around valid tickets obtained against the old key.
Thanks for the explanation, Simo.
Filed RH bugzilla report:
https://bugzilla.redhat.com/show_bug.cgi?id=799007

Ondrej