Local/in-process KMS client backend.
This backend is the default for KMS. It calls the KMS contexts directly and uses
the configured KMS repo plus the configured RMK provider.
Local calls without :session are trusted/admin calls for RMK-only aliases.
Session-protected aliases still require a usable recipient session. Pass
session: secret to operations such as encrypt_alias/3 and decrypt_alias/3
when KMS should enforce principal bindings and recipient-key possession.
Configure explicitly with:
config :kms, :client, KMS.Client.Local