Hyper-V Live Migration with Encrypted VHDX: Key Provisioning Limitation on Destination Hosts

Goal

Achieve zero-downtime Live Migration of a VM that uses an encrypted VHDX on Windows Server 2022 Hyper-V.

Constraints and uncertainty

Live Migration of an encrypted VHDX succeeds only when the destination host already holds the identical encryption key in its DPAPI vault. Hyper-V does not transfer or generate the key during migration, and Storage Live Migration does not bypass this requirement. There is no built-in mechanism to synchronize keys automatically, so any key-provisioning step must be completed before the migration begins, introducing a potential operational gap.

Questions

1. What is the supported method to pre-provision the encryption key on the destination host without manual export/import of the DPAPI blob?
2. Does Windows Server 2022 provide any cluster-level or PowerShell-based key-distribution feature that eliminates the pre-staging requirement?
3. If no native solution exists, what is the documented fallback that guarantees zero downtime during the key-synchronization window?