dev.knotless.runnerKey

Kept in the runner's account. An owner seals each secret it gives the runner to this key, with HPKE (RFC 9180) in base mode: DHKEM(P-256, HKDF-SHA256), HKDF-SHA256 and AES-128-GCM, so only the runner, which keeps the private half, can open it. The runner writes it again when its key changes; a value sealed to an older key names that key.