Transit Encryption

[gawsoftpl]

I would like to write new class for encrypt data via transit for example in Hashicorp Vault. I'm wondering whether to write a new Backend class or KeyProvider class?

Solution 1 new backend class: when execute encrypt, method will send request to vault server for encrypt data

Solution 2 new key provider class: Store CIPHERSWEET_KEY as encrypted string by vault transit when execute getSymetricKey method will send request to vault server for decrypt CIPHERSWEET_KEY

Which solution will be the best?