pub fn setup_run_encryption(
kek: &Kek,
indexable_columns: &[(u16, u8)],
) -> Result<RunEncryption>Expand description
Assemble per-run encryption material from a KEK: generate a DEK, build
the page cipher, wrap the DEK into a descriptor, and derive+wrap a per-
column key for each ENCRYPTED_INDEXABLE column ((column_id, scheme)).
Each KEK wrap uses a distinct nonce (DEK vs column keys) so AES-GCM never
sees nonce reuse under the KEK.