What makes the transit rewrap operation safe to run from an untrusted process?

Why this is the answer

Rewrap decrypts with the appropriate key from the keyring and re-encrypts with the newest one, and the plaintext is never returned — so a batch job can walk a database upgrading rows without being trusted with the data it is upgrading. No original key is presented; transit keys never leave Vault. Sudo is not required, and requiring it would rule out exactly the automated use this design enables. Rewrap returns new ciphertext for the caller to store; it does not silently keep the old copy.