Offline key caching

A customer goes out to a field office, that is off the grid. They want to be able to encrypt things with a key, but they can't talk to KMS. The idea would be they could fill up some cache of keys prior to going offline, then when they need to encrypt data, they can use those keys.

No files, tests, or entry points are named. First clarify the offline key-caching requirements, including cache behavior and key-management constraints, then identify the relevant encryption and KMS integration areas. Done means users can pre-cache keys before disconnecting and encrypt data while offline.

Written by the indexing model from the issue text.