KMS wrapping libraries split out from Vault