afaics the use for the hook library usage on the encryption sdk is doing fairly trivial stuff that would be easily replaced by a call to kms_client.decrypt .. the use of the encryption sdk brings in native compiled extensions requirements and dependencies (cryptography library), and in general is targeted towards more advanced usage then what is needed here. removing it in favor of the simple thing seems like an easy usability/deployment win.