---
features:
  - Added ability to rewrap project KEKs (key encryption keys) when doing an
    upgrade.  This allows deployers to rewrap KEKs whenever they rotate the
    master KEK and HMAC keys when using the PKCS#11 plugin behind Barbican.
  - Also added some needed ordering for master key creation, sync and update
    when using a Thales HSM behind Barbican.