This is old as dirt, but put a rubber end on the wrench that you use, so it doesn't leave marks.
The Wii U has lots of keys: its OTP is 8 times the size of the Wii OTP (1KB in 8 banks of 128 bytes, instead of a single bank of 128 bytes). Incidentally, bank 0 is the vWii bank (and all the other banks are disabled in vWii mode, so it only gets to see the keys that it needs, which are the same ones that were present on Wiis).
Espresso vWii ancast key
ce3641b2660253f5a7e789db297be2c1585b3054
Found in the Espresso's key fuses/OTP. Used to decrypt the vWii System Menu and the new NANDloader binaries (1-512 and 1-513) at load time. Disabled by the boot ROM until reset.
Espresso Wii U ancast key
2ba6f692ddbf0b3cd267e9374fa7dd849e80f8ab
Found in the Espresso's key fuses/OTP. Used to decrypt the Cafe OS kernel at load time. Disabled by the boot ROM until reset.
Wii U common key
6a0b87fc98b306ae3366f0e0a88d0b06a2813313
Found in the Starbuck's OTP. Used to decrypt the specific title key for every Wii U application (this is done at installation time for system firmware and installable titles, and at load time for disc games). Note that Cafe OS and Starbuck binaries are double-encrypted with their own ancast keys too.
vWii common key
2b30b703c6676c8124c7347b30c7972ffeae2b39
Found in the Starbuck's OTP. Used to decrypt the specific title key for vWii system updates (since the key is only needed at installation time, vWii mode doesn't actually have access to it). Note that the System Menu and NANDloaders are double-encrypted with the vWii ancast key too.
Wii U ancast key
d8b4970a7ed12e1002a0c4bf89bee171740d268b
Found in the Starbuck's OTP. Used to decrypt Starbuck binaries (Wii U IOS and cafe2wii). Unlike the Espresso keys, this one is enabled forever (except in vWii mode, of course), as the Starbuck boot0 really only runs at boot time, and Starbuck ancast binaries are simply parsed and decrypted by IOS itself when reloading.
Wii U boot1 key
Found in the Starbuck's OTP. Used by boot0 to decrypt boot1. This key, and it alone, is selectively disabled in a special clear-only OTP mask register by boot0, and is not available after boot. We don't have it yet!