code: func (e *Engine) unsealMasterKey(ctx context.Context) (*secure.Secret, error) {
  	if !e.sess.HasPassphrase() {
  		return nil, ErrMissingPassphrase
  	}
  
  	ts, err := newTriplesec(ctx, e.sess.Passphrase())
  	if err != nil {
  		return nil, err
  	}
  
  	masterKey, err := e.sess.MasterKey()
  	if err != nil {
  		return nil, err
  	}
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, err
  	}
  
  	mk, err := ts.Decrypt(*masterKey)
  	if err != nil {
  		return nil, err
  	}
  	return e.guard.Secret(mk)
  }
docs: // unsealMasterKey uses the scrypt stretched password to decrypt the master
  // password, which is encrypted with triplesec-v3