Support a one-way encryption scheme

I would like a way to support a one-way encryption scheme more seamless than currently possible. Here is the scenario I'm proposing:

I have a KMS service

I have a developer and a target(CICD, K8 cluster, server, etc.).

I'd like to give the developer only access to encrypt a DEK rather than being able to decrypt the DEK and therefore gain access to the encrypted payload and I'd like to give the target access to decrypt.

When a developer needs to add/modify a new secret to the existing file, SOPS would generate a new DEK and encrypt that section of the payload and the DEK and checks it in and does not modify the unmodified secrets. When the target receives this mixed payload, it should be able rencrypt all of the payload with this new DEK.

This is somewhat negates some of the nice usability features of SOPS but can be desirable in certain scenarios. Let me know if this makes sense in context of this project.

The issue does not identify files, tests, or entry points. Start by reviewing SOPS's existing encryption and key-management flow, then clarify the proposed developer and target permissions and mixed-payload re-encryption behavior. Done requires an agreed design and implementation path for the one-way workflow.