Is it possible to get a shamir based root key for HCP, and disable the ability to generate a token on the dashboard?