Sealed capabilities should directly derive from the capabilities they
seal. If the sealer's rights are ever revoked, the unseal will fail, but
the sealed capability object itself should also be revoked.