Generated once per identity:

master_key = random(32 bytes)

Stored:

• locally in secure storage (OS keychain / hardware enclave)
• optionally split using Shamir / MPC
• never uploaded raw
• never used directly

The Master Key never leaves the Vault.