A DEK wrapped for a single recipient.
Recipient type.
Base64-encoded wrapped DEK.
Hex-encoded ephemeral public key(s).
Optional
Hex-encoded ML-KEM ciphertext (PQ recipients only).
A DEK wrapped for a single recipient.