the KMS creates a new Covercrypt object at each call:

[ackRow]

Changed but it seems that the KMS is designed to create a new Covercrypt object at each call anyway:

rekey_keypair_cover_crypt(kms, Covercrypt::default(), &owm.id, user, action, params).await

Originally posted by @ackRow in https://github.com/Cosmian/kms/pull/63#discussion_r1379816736