Vault Key Access

Keys are unlocked using:

• PIN / password → stretched via Argon2id
• biometrics → OS / hardware
• hardware wallet (optional)
• recovery scheme (if control keys lost)

Private keys NEVER decrypt the Vault. Only the Master Key does.

vault.keys.rotateControl()
vault.keys.rotateRecovery()
vault.keys.exportPublic()