very lazy and quick edit of hailey's pds migration script in a way i think should let you just add a rotation key. untested, use at your own risk

add_rotationkey.ts

import AtpAgent from '@atproto/api'
import { Secp256k1Keypair } from '@atproto/crypto'
import * as ui8 from 'uint8arrays'

const OLD_PDS_URL = 'https://bsky.social'
const CURRENT_HANDLE = 'haileyok.com'
const CURRENT_PASSWORD = ''
const TOKEN = '' // Use `getEmail` first, and set this to the token that you receive.

const getEmail = async () => {
  const oldAgent = new AtpAgent.AtpAgent({ service: OLD_PDS_URL })
  await oldAgent.login({
    identifier: CURRENT_HANDLE,
    password: CURRENT_PASSWORD,
  })
  await oldAgent.com.atproto.identity.requestPlcOperationSignature()
}

const migrateAccount = async () => {
  const oldAgent = new AtpAgent.AtpAgent({ service: OLD_PDS_URL })

  await oldAgent.login({
    identifier: CURRENT_HANDLE,
    password: CURRENT_PASSWORD,
  })

  const accountDid = oldAgent.session?.did
  if (!accountDid) {
    throw new Error('Could not get DID for old account')
  }

  // Generate new keypair
  const keypair = await Secp256k1Keypair.create({ exportable: true })
  const privateKey = await keypair.export()
  const rotationKey = keypair.did()
  console.log('SAVE THIS PRIVATE KEY!!!')
  console.log('rotation key: ', rotationKey)
  console.log('private key: ', ui8.toString(privateKey, 'hex'))

  // Get current DID credentials
  const getDidCredentials = await oldAgent.com.atproto.identity.getRecommendedDidCredentials()

  if(getDidCredentials.data.rotationKeys == null) {
    throw new Error("No rotation keys found")
  }

  // Add new rotation key
  getDidCredentials.data.rotationKeys = [rotationKey, ...getDidCredentials.data.rotationKeys]

  // Sign PLC operation
  const plcOp = await oldAgent.com.atproto.identity.signPlcOperation({
    token: TOKEN,
    ...getDidCredentials.data,
  })

  // Submit PLC operation
  await oldAgent.com.atproto.identity.submitPlcOperation({
    operation: plcOp.data.operation,
  })
}

// STEP ONE IS HERE
getEmail()

// STEP TWO IS HERE. COMMENT OUT THE ABOVE AND UNCOMMENT THIS ONCE YOU HAVE YOUR CODE
// migrateAccount()