anchor.diff:     been chosen, assuming that AES-NI or SSE3 are available, it is desirable to
      not have to require these CPU features for the system to operate safely.
   
  -
  +## Recovery Scenarios
  +
  +This is currently a placeholder, the intention is to add recovery scenarios
  +and the example steps that would occur to recover. The design is such that
  +as long as the `rfd77:config` property is intact, one should be able to either
  +use the token 9a key or N of M recovery secrets (assigned to individuals) to
  +recover the encryption key and mount the zpool.  We want to be able to validate
  +the sequence of steps (including potential mis-steps) with the actions of
  +KBMAPI and kbmd to minimize (or hopefully eliminate) any scenarios that lead to
  +the loss of the zpool encryption key (and thus loss of data in the zpool).
  
positive.code: The hardware details of these devices and the interfaces they expose is
  discussed further in the section <<hardware>>.
  
  ### Overview: at-rest encryption
  
  The concept for at-rest encryption is to use a randomly-generated key, and then
  
negative.code:     License, v. 2.0. If a copy of the MPL was not distributed with this
      file, You can obtain one at http://mozilla.org/MPL/2.0/.
  
      Copyright 2019 Joyent Inc
  ////
  
  # RFD 77 Hardware-backed per-zone crypto tokens
  