It’s a trade off between speed and security, and my assumption is that they’ve chosen to do it this way so that the encryption key isn’t sitting on the device d

It’s a trade off between speed and security, and my assumption is that they’ve chosen to do it this way so that the encryption key isn’t sitting on the device during transit. By doing it this way even if someone can intercept data while it’s being shipped between the customer and AWS all they’re going to get is a disk full of random bytes.