With GETVPN, if a key server is configured to use multicast as the rekey transport mechanism, then under which of these conditions will the key server retransmit the rekey messages?

The key server does retransmit rekey messages when using multicast - it always does so to compensate for the inherent lack of delivery acknowledgment in multicast transport.

Multicast does not support per-member acknowledgment, so the key server cannot detect a missing acknowledgment from any individual group member.

Acknowledgment-based conditional retransmission applies to unicast rekey transport, not multicast, because multicast does not provide a return-path acknowledgment from receivers.

Dead Peer Detection (DPD) is used to detect failed peers in IPsec but does not serve as the trigger for rekey retransmissions in a GETVPN multicast rekey scenario.

Because multicast is a one-way, unacknowledged transport, the key server has no way to determine whether any specific group member received the rekey message. To ensure all group members receive updated keys and security associations before the current ones expire, the key server always retransmits the rekey message a configured number of times regardless of perceived delivery status.