A Fact.Encryption.KEKProvider that takes the KEK directly from the options.

This is the simplest provider — the caller supplies the key material when opening the database. Key sourcing (environment variables, vault clients, config files) is the caller's responsibility.

Examples

Fact.open("data/turtles",
  encryption: [
    kek_provider: Fact.Encryption.KEKProvider.Explicit,
    kek: System.fetch_env!("FACT_KEK") |> Base.decode64!()
  ]
)