The <vault> element in standalone/domain.xml takes a 'code' attribute specifying the class to use as the implementation. It does not let you specify a 'module' option like most similar elements have, and instead always loads the class from the org.picketbox module.
The <vault> element should take a module option too.
The current workaround is to add the custom vault module as a dependency in the org.picketbox module.
Additionally, hanging any module.xml can also result in patching conflicts when customers apply future updates.
Since we have a quite a few customers writing custom vault implementations for various pieces of functionality that it doesn't provide out of the box, we should consider making this type of customer-initiated change patch safe for customers.