A simple round-robin pool ignores cooldowns. A useful pool needs to know when a credential can return to service, which credential was used recently, and what callers should do when every credential is cooling down.
The implementation can stay small: keep timestamps per key, select the least-recently-used available credential, and await the earliest cooldown when none are available.