Whelp. That was work. Two OpenBao nodes, each holding the rekeying secret for the other, both storing their unsealing keys in the host TPM, automatic mutual rekeying, automatic failure recovery (each node gets two slots in the TPM to hold unsealing keys, a slot for last/current and a slot for current/next). Automatic e2e provisioning on k8s on my laptop, and I _never see a key during the entire process_.