How-to rekey vault (recovery-keys) when using auto-unseal