during rekeying, unwrap current and new master secrets by the internal control KEK used in MasterSecretGenerator