Comprehensive and Detailed In-Depth Explanation:

The Transit rewrap feature re-encrypts data safely. The Vault documentation states:

"Luckily, Vault provides an easy way of re-wrapping encrypted data when a key is rotated. Using the rewrap API endpoint, a non-privileged Vault entity can send data encrypted with an older version of the key to have it re-encrypted with the latest version. The application performing the re-wrapping never interacts with the decrypted data."

—Transit Rewrap Tutorial

C: Correct. Rewrap avoids decryption risks:

"Using the transit rewrap feature in Vault allows you to re-encrypt the data without decrypting it first."

—Transit Rewrap Tutorial

A: Rotation doesn’t re-encrypt existing data.

B: Manual decryption exposes data.

D: Master key changes don’t affect Transit data.