Add helpers for domain KEK encryption/decryption