A Vault cluster uses auto-unseal with an external KMS. What operational dependency must be considered?

1. A recovery share always replaces a missing KMS key by itself
2. Availability and authorization of the configured KMS key service
3. The storage backend is no longer needed
4. Every user must manually enter the KMS key into each login request