The closest I've seen to this is deca just changing rc4 keys whilst letting the old outgoing key still work as to catch outdated proxies.
I highly doubt deca has enough iq to catch any hacked clients, especially with most being external and using rpms that can only be detected from kernel/kerneldrivers, but even if they did they are restricted purely to the limits of the unity engine which is garbage shit and I doubt give enough freedom for anything like that