Expand description
Sealed Drops: application policy until a condition holds.
dd.seal-until is not a cryptographic time-lock. Honest nodes refuse to
decrypt before until. A dishonest recipient who already has the CEK wrap
can ignore the extension. Prefer key-release / quorum receipts when available.