Envelope encryption with configurable KMS
github.com/autotelic/envelope-encryptor
autotelic/envelope-encryptor