Encryption.deriveSubkey takes a single masterKey today. Rotation needs the manifest header to carry a key-version byte and the encrypt path to know which key is current. Decrypt picks the right master based on version. Out-of-scope work spelled out in BodyCodec.ts comments.
Encryption.deriveSubkey takes a single masterKey today. Rotation needs the manifest header to carry a key-version byte and the encrypt path to know which key is current. Decrypt picks the right master based on version. Out-of-scope work spelled out in BodyCodec.ts comments.