The request is multipart/mixed with two parts:

1. application/jose+json — JWE General-JSON header (detached ciphertext).
2. application/octet-stream — proprietary binary envelope followed by the ciphertext and GCM tag.

The plaintext is streamed directly to the response body.


Supports both SIMPLE keys (single recipient)
and COMPOSITE keys (multiple recipients).

For COMPOSITE keys, decryption uses all recipients to derive
the final content encryption key.