Documentation / Platform glossary / Root Key / Root of Trust
A root of trust is the point where a key hierarchy stops depending on something else. Every subordinate key derives its authority from it, and because nothing above it can vouch for it, its protection must come from hardware or a managed key service rather than from another key.
The root's defining property is that it is not protected by another key. Data keys are protected by wrapping keys, which may be protected by master keys — but the chain has to terminate somewhere, and at that point protection becomes physical and procedural rather than cryptographic.
That is why roots live in hardware security modules or cloud key management services. In both cases the key material is generated inside the boundary and never leaves it: callers submit data to be signed or wrapped and receive results, but cannot export the key. A root that can be exported is not meaningfully a root, because a copy of it is a copy of the entire hierarchy's authority.
Access is correspondingly restricted. Root operations are typically dual-controlled and comprehensively logged, because a root compromise cannot be remediated by rotation — every key beneath it must be treated as exposed.
The root also does very little. It signs or wraps subordinate keys and is otherwise idle. Low usage is a security property: fewer operations mean a smaller attack surface and a log volume small enough that anomalies are visible rather than buried.
Roots must nonetheless be recoverable. Losing the root means losing everything under it, so recovery design matters as much as access control — and is harder, since any backup is an exportable copy needing equivalent protection.
An encryption story without a named root is incomplete, because "encrypted" begs the question of what protects the keys. Identifying the root — and whether it is hardware-backed, non-exportable, and dual-controlled — is what makes the rest of the hierarchy credible.
The root is also where availability and confidentiality pull in opposite directions: it must be almost impossible to obtain and reliably reachable, and how that tension is resolved says more than any diagram.
QueryTek anchors document encryption in managed key infrastructure where root key material is not exportable and root-level operations are restricted and logged. The specific provider, key identifiers, and recovery procedures are not published.
