There are two ways tenant secret can be generated. If you purchase Salesforce Shield license, then you can generate tenant secret from Salesforce.
Generate a Tenant Secret with Salesforce
You can periodically rotate tenant secrets and data can be encrypted with those keys.
You can also generate your own tenant secret (BYOK) if you don't want to use Salesforce provided tenant secrets. Refer Generate Your Own Tenant Secret (BYOK)
It is based your organization's security policy which tenant secrets you could use. If an organization generates their own secrets then they will try to use Hashed tenant secrets.
Just want to clarify, if you upload any of the above secrets then only newly created or edited records can be encrypted. To encrypt existing records, you need to contact Salesforce so that they will run background jobs for that.
According to documentation Generate and Wrap Your Tenant Secret, Tenant wrapping key contains:
Generate a random number as your tenant secret. Then calculate an SHA256 hash of the secret, and encrypt it with the public key from the certificate you generated.