Because we can't generate the unprotected key outside of the master, and it's also not needed on a capsule at all