Envelope encryption separates data keys from master keys

Each piece of data gets its own key, and those keys are themselves encrypted by a master key held somewhere stronger.

It means rotating the master key does not require re-encrypting all the data, and the data keys can be stored alongside the data safely. It is the pattern behind most cloud encryption services, and it is what makes key rotation tractable at scale.