key management security model

[tgross]

Because multiple pnode clients connect to a given vault, each using their own keys to decrypt entries, the key that's used for the vault itself is by necessity shared. Describe the security model for the vault and how its keys should be handled.