This is called using a KEK (key encryption key) to encrypt a DEK (data encryption key) or a FEK (file encryption key), depending on the exact purpose. As you p

This is called using a KEK (key encryption key) to encrypt a DEK (data encryption key) or a FEK (file encryption key), depending on the exact purpose. As you point out, erasure can rotate keys. What Apple apparently didn't provide was a straightforward way for key rotation as a key management function. This surely appears to have been rushed to market.