I need to authorize a third party to create/update a document in my vault. How do I enforce the keyAgreement key?

[llorllale]

Is that what the keyAgreement key in the data vault configuration is for?

Does that enforcement only apply to parties other than the controller of the vault?

Is there a mechanism for enforcing pair-wise keyAgreement keys as opposed to a single public one?

[DRK3]

Discussed on July 22, 2021 WG call:

• KeyAgreement can be shared across recipients
• Server can reject documents that don't include the recipient
• Spec may want to non-normatively reference other specs like WebKMS
• Choose a better name for this
• May be easier to have a single recipient and have other parties manage that key

[dmitrizagidulin]

Discussed on Sep 2, 2021 call.

Given that this is a frequent question ("How do I share / authorize one or more third parties, without re-encrypting"), we need to add a non-normative section discussing how to share. Specifically, adding one layer of indirection, and giving third parties access to a key-agreement key, via something like WebKMS.