Function derive_untrusted_key 

pub fn derive_untrusted_key(
    parsed: &ParsedFile,
    password: &SecureString,
) -> Result<SecureKey, WorkflowError>

Derives a parsed file’s key from a password, guarding the (untrusted) KDF parameters its header requests.

Validates the request against the bounds above and, only if it passes, runs the file’s own key derivation while holding a reservation against the global memory budget. This is the single intended entry point for header-supplied parameters: fusing the two steps makes it impossible to run an unvalidated derivation from a crafted file.