Identifies a storage encryption key. Not secret: every encrypted record carries the ID of the key that sealed it, so a future key can coexist with this one during a re-encryption (docs/storage-encryption.md).