title: Clarifying Vault key decryption process
body: <p>I'm trying to understand Vault workflow w.r.t. keys, e.g.: <a href="https://www.vaultproject.io/docs/concepts/seal" rel="nofollow noreferrer">https://www.vaultproject.io/docs/concepts/seal</a></p>
  <p><img src="https://i.stack.imgur.com/73dg2.png" alt="1" /></p>
  <p>As I understand,</p>
  <ul>
  <li>unseal (shared) keys are provided on init</li>
  <li>they're used to acquire the combined key</li>
  <li>combined key is then used to decrypt a root (master) key (which is apparently stored in the sealed vault)</li>
  <li>root key is then used to decrypt the data encryption key (or a keyring which contains it?..)</li>
  <li>the data encryption key is then used to en/decrypt the data in Vault</li>
  </ul>
  <p>I get the unseal keys on init, how can I inspect the other keys? Is it impossible / are those keys just stored somewhere internally in Vault?</p>
  <blockquote>
  <p>Unsealing is the process of obtaining the plaintext root key necessary to read the decryption key to decrypt the data, allowing access to the Vault.</p>
  </blockquote>
  <p>Is the data encryption key / keyring also decrypted during the  unseal, or is it... maybe decrypted on each Vault operation (so only the root key is stored somewhere in plaintext after the unseal)?</p>
  <p>Is it ok that the root key is stored in plaintext after the unseal? Or is it still protected by passwords/tokens?.. Or if it's just transiently used to decrypt the data encryption key / keyring, then how are those protected? I guess it has smth to do with the lock icon on the image :)</p>
  <p>I'm somewhat confused about how it all works.</p>