A Shamir-sealed Vault cluster requires three of five key shares to unseal. How many distinct valid shares meet that threshold?

1. Three
2. One share submitted three times
3. Any ordinary application token
4. All five shares are always required