{ SET ENCRYPTION KEY
  {
    [ "certificate_id" ] IDENTIFIED BY "wallet_password"
    |
    IDENTIFIED BY "HSM_credentials" [ MIGRATE USING "wallet_password" ]
  }
}