I am not sure what you are heading towards.
SHA256 is not encryption. It is a hashing method. You can sign or encrypt the results of hashes and use that as a protection (quick to hash, and if the signing/encryption acts to verify the hash then all good).
Secondly I am not sure what you are heading towards with master key. Nintendo will have used asymmetric encryption. This is to say you have one key that does the encryption and another the decryption. You keep the encryption key locked tight in your bunker* while you can give publish the other key on the front of every newspaper in the world if you wanted to (they still try to keep it reasonably hidden as it can help slow some hackers but usually no big deal unless you made some other mistakes).
*unless you are Sony with PSP and PS3. There they included the PSP private keys on every PS3, and when the PS3 got hacked some then realised all included the PSP private keys and that is why things don't necessarily need a custom firmware any more on the PSP. They also screwed up the PS3 encryption so hard that it basically gave away the private key but that is a different matter.
Or do you mean the new keys they generate from time to time to encrypt new games and hackers have to delve into the system to find where they stored those?