A 256-bit key for record-level client storage encryption, with its id.
Belongs to its own cryptographic domain: never derive it from, or reuse it as, an identity, prekey or session key. The bytes are copied in and out; toString never shows them.
A copy of the key bytes, for a StorageKeyProvider that has to persist the key in platform key storage. Wipe the copy after use.