From the spec:

For ClientEncryption.createDataKey(), the new document MUST be inserted into the key vault collection with write concern majority.

For encrytion/decryption that requires keys from the key vault collection, the find operation MUST be done with read concern majority.