Generate root token from unseal key: root generation aborted: unable to authenticate: unable to retrieve stored keys

Using Vault 1.6.2

Following the instructions to generate a root token from an unseal key:

We are able to unseal the Vault with the single unseal key.
All proceeds fine until we get to step 3, when we observe this failure:

$ echo -n $VAULT_UNSEAL_KEY | vault operator generate-root -format=json -nonce=$VAULT_NONCE -
Error posting unseal key: Error making API request.

URL: PUT http://127.0.0.100:8200/v1/sys/generate-root/update
Code: 400. Errors:

* root generation aborted: unable to authenticate: unable to retrieve stored keys: failed to encrypt keys for storage: cipher: message authentication failed

Appreciate any hints or tips on what may have gone wrong.