Decide on the encryption strategy for items/files

Requirements to consider:

- Encryption should allow for external entities to access and decrypt the items they are granted permission for.
- Encryption should not require undue duplication and expensive client processes to effect (e.g. re-encryption/re-keying)
- Permissions can change dynamically, adding or removing external entities from access to future modifications of items. We need to decide how we will deal with this, which has impacts across the way encryption and items are structured/linked/bucketed at lower levels in the stack.