An escrowed KEK entry — stores ENCRYPTED KEK (simulating HSM protection). The plaintext KEK is NEVER stored.