Uses the Transit Secret Engine of a different Vault cluster

• The Transit Secret Engine may be configured in a Namespace

• The Transit Unseal supports key rotation

• Available in open source and Enterprise

• The core Vault cluster must be highly-available