Hey, is there a way to decouple the rke2 token (the one used for joining the cluster) from the cluster certificates (root/server)? I'm aware of the doc saying that the short format of the token can be used when joining, what interests me more is to use a key for the etcd snapshots encryption that isn't dependent on a certificate.

You only need the short form to decrypt. The snapshots themselves are not encrypted, it is the ca certs in the datastore (and in starter snapshots) that are encrypted with the token - and only the passphrase part, not the whole thing. I am pretty sure this is covered in the docs.