We were pretty concerned about this. It's hard to get in a situation where the data is unrecoverable, because the root keys that you distribute can be used (with a bit of reading Vault code) to directly decrypt the internal storage, which is easy to navigate.

On a more general note, its taken us a long time to get comfortable with using Vault for increasingly critical things, and we are now at the point where it being down is extremely critical. But there are several components like this, and we are able to tolerate node failure, so its somewhat acceptable.