pub fn derive_key(master: &[u8], audience: &str) -> [u8; 32]Expand description
Derive a 256-bit AEAD key for audience from a login/entitlement master
secret via HKDF-SHA256. Deterministic: the same (master, audience) yields
the same key on every device (a user’s Mac and phone decrypt each other’s
ops); distinct audiences ("personal" vs "org:<id>") yield independent keys.