Once a full FieldReencryptor pass has upgraded every row off an old DEK version, that version can be removed from the keyring secret to shrink the unwrap set and bound exposure. Add an opt-in prune that only drops a version after a verified full re-encryption pass (or a usage check), so a still-referenced version is never removed. Depends on #7.
Once a full
FieldReencryptorpass has upgraded every row off an old DEK version, that version can be removed from the keyring secret to shrink the unwrap set and bound exposure. Add an opt-in prune that only drops a version after a verified full re-encryption pass (or a usage check), so a still-referenced version is never removed. Depends on #7.