When unsealing Vault, each Shamir unseal key should be entered:

When unsealing Vault, each Shamir unseal key should be entered by different administrators each

connecting from different computers. This is because the Shamir unseal keys are split into shares that

are distributed to trusted operators, and no single operator should have access to more than one

share. This way, the unseal process requires the cooperation of a quorum of key holders, and

enhances the security and availability of Vault. The unseal keys can be entered via multiple

mechanisms from multiple client machines, and the process is stateful. The order of the keys does

not matter, as long as the threshold number of keys is reached. The unseal keys should not be

entered at the command line in one single command, as this would expose them to the history and

compromise the security. The unseal keys should not be encrypted with each administrator’s PGP

key, as this would prevent Vault from decrypting them and reconstructing the master key. Reference:

https://developer.hashicorp.com/vault/docs/concepts/seal3,

https://developer.hashicorp.com/vault/docs/commands/operator/unseal