If the key is to be encrypted, another key is needed, and so on. DPAPI allows developers to encrypt keys using a symmetric key derived from the user's logon secrets, or in the case of system encryption, using the system's domain authentication secrets.
For encryption, an extra key is needed. Developers can use a symmetric key derived from the user's logon secrets for this purpose, or for system encryption, the domain authentication secrets are employed.