where are encryption keys sent or stored when users roam between tunneled mode APs on the same contr

In a campus environment, where are encryption keys sent or stored when users roam
between tunneled mode APs on the same controller using 802.1X?

A.
sent to the new AP via GRE

B.
sent to the new AP via IPSec

C.
stored on the controller

D.
stored on the RADIUS server

E.
original AP sends keys to new AP