const (
	tlsClientSessionCacheSize = 100
)

var replicateKeyID = sync.OnceValue(func() bool {
	if v, ok := os.LookupEnv(EnvKMSReplicateKeyID); ok && strings.ToLower(v) == "off" {
		return false
	}
	return true // by default, replicating KMS key IDs is enabled
})

// ReplicateKeyID reports whether KMS key IDs should be included when

		// always set the SSE-KMS header. If no KMS key ID is
		// specified, MinIO is supposed to use whatever default
		// config applies on the site or bucket.
		var keyID string
		if kms.ReplicateKeyID() {
			keyID = objInfo.KMSKeyID()
		}

		sseEnc, err := encrypt.NewSSEKMS(keyID, nil)
		if err != nil {
			return putOpts, false, err
		}
		putOpts.ServerSideEncryption = sseEnc
	}