pub fn wrap_dek_to(
recipient_public: &[u8; 32],
dek: &DataKey,
) -> Result<Vec<u8>, String>Expand description
Seal (wrap) a DEK to a recipient’s public key — the credential’s wrapped_key. Only the holder of
the matching secret can unwrap_dek it; destroying this blob (revocation) removes that access.