Minor Description
Maybe add an optional IT test to aggressively seek on an SSE-KMS test file to see if it can overload the KMS infra. The default limit is 600 requests/second. This may seem a lot, but with random IO, every new HTTPS request in the chain is potentially triggering a new operation.
Someone should see what happens: how easy is it to create, and what is the error message.
This may not be something we can trigger in a simple IT test, just because it's single host.