Your password derives your vault encryption key. A securely wrapped copy is escrowed so designated trustees can access your vault upon verified life check (not zero-knowledge).