Shamir to AWS KMS seal migration failure