The current default for vaults is the standard vault.

The standard vault is a vault that can be acced by anyone that have access to the kra key and accessible by the framework directly.

The "standard vault" is therefore not a good default as any admin can access it.

User's must take an actual explicit step to choose such a vault and they must be prominently warned that IPA administrator can access secrets stored in such a vault at any time.

The default vault should probably be the "symmetric vault".