We should add a config option to use get for audit encryption instead of encrypt / decrypt. We then need to add support in the KMIP keystore to support this operation. This will involve retrieving the key from the KMIP keystore, encrypting the local encryption key, and storing the relevant metadata in the header (letting the decryptor know that the get operation was used).