pub const BOOTSTRAP: &str = "bootstrap";
KMS-protected, unencrypted boot keyspace (TEE integrity manifest, etc.).