That makes perfect sense, two weeks is way too early to deploy something in production. Also, good call on not using openssl(1) in production. Last time I chec

That makes perfect sense, two weeks is way too early to deploy something in production. Also, good call on not using openssl(1) in production. Last time I checked that CLI was primarily meant for testing, and anyway is full of sharp edges. Not sure what AES-256-GCM vs ChaCha20Poly1305 has to do with KMSs though? I ask because age is specifically designed to support pluggable key wrapping mechanisms to support KMSs. You can write a plugin that talks to your KMS to wrap the file key, and use age for everything else. Surely you're not sending the whole file payload to the KMS.