When unsealing Vault each Shamir unseal key should be entered:

Entering keys sequentially from one system contradicts the security best practice of distributed control and introduces a single point of failure.

The Shamir secret sharing algorithm distributes master key shares among multiple trusted operators. For unsealing Vault, each operator should enter their key from a different machine to prevent a single point of compromise and ensure multi-person control over the unseal process.

While PGP can be used for securing the key at rest, the unsealing process itself involves entering the decrypted key share, not encrypting it during entry.

Unseal keys are entered individually, not as part of a single command, to enforce the multi-operator requirement for security.