Key encryption key
A key whose only job is to encrypt other keys, so that only this one needs protecting in hardware.
A key encryption key (KEK) wraps the data encryption keys (DEKs) before they are stored on disk or sent over the network. The number of secrets that must be guarded stays small. The KEK sits in an HSM, and thousands of wrapped DEKs can sit encrypted in a database right next to the data they unlock.
Rotation gets easier too. Change the KEK and only the wrapped keys need rewrapping, not all of the data. The downside is that whoever gets hold of the KEK gets everything beneath it. That is why real systems tend to stack several levels, and why key hierarchy deserves its own entry.