Wavelynx — credential key lifecycle

How a per-credential symmetric key moves from Wavelynx's HSM-rooted master keys all the way to a wrapped envelope on the user's device. The diversified plaintext per-credential key never leaves the secure server boundary and is never persisted — regenerated on demand from the master key via the same deterministic diversification function.