Unable to decrypt/encrypt with azkv that uses CNAME alias

I am currently using an older version of sops but started work on migrating to 3.10.2 recently but ran into an issue around my use of a CNAME alias for my Azure KeyVault endpoint.

The release of 3.11 appears to have added support for setting client options via PR #1838, but no associated documentation on how to handle this.

Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  https://<redacted>/keys/sops-secrets-key/<redacted>: FAILED
    - | failed to decrypt sops data key with Azure Key Vault key
      | 'https://<redacted>/keys/sops-secrets-key/<redacted>':
      | challenge resource "https://vault.azure.net" doesn't match
      | the requested domain. Set
      | DisableChallengeResourceVerification to true in your client
      | options to disable. See https://aka.ms/azsdk/blog/vault-uri
      | for more information

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.

Is this new functionality not a user facing option at this time or am I simply missing something?

Start with PR #1838 and the Azure Key Vault handling it changed; no file or test is named in the issue. Check how client options are exposed and document the setting needed for CNAME aliases, including how users enable it. Done means the supported configuration is documented clearly enough to avoid the challenge-resource error.