Default kura_keyring - reads keys from the kura application environment.

[{kura, [
    {encryption, #{
        active => 1,
        keys => [
            {1, <<"S2V5T25lLi4uMzIgcmF3IGJ5dGVzLi4uYmFzZTY0ISE=">>},
            {2, <<"S2V5VHdvLi4uMzIgcmF3IGJ5dGVzLi4uYmFzZTY0ISE=">>}
        ]
    }}
]}].

Each key is a base64-encoded 32-byte value. active is the key_id used for new writes; rotate by adding a key and moving active to it. Keys that do not base64-decode to exactly 32 bytes are treated as absent.