Every app instance gets its own credential, and it expires on its own

Covers Vault's dynamic secrets as its signature feature, and explains envelope encryption's two-layer key design.