When I tried to change the password for SYS, I got an ORA-28017 error message. This was caused by a manual DB upgrade to 12C without upgrading the password file as well.
There was some more discussion around Transparent Data Encryption.
I am assured by the architect that the business understands that they will lose data if the key is ever lost.
This assurance seems to me to be a lot like when a business makes its first business continuity plan. Everyone understands that it will take time and effort. Then they scream loud and clear when a business continuity exercise is actually done. They could not make the leap from what they were told to what they experienced.
Notes on the Oracle webinar, Label Based Access Controls in Oracle Database 11g by Kamal Tbeileh.