}
	switch {
	case lookup(EnvKMSEndpoint):
		rawEndpoint := env.Get(EnvKMSEndpoint, "")
		if rawEndpoint == "" {
			return nil, errors.New("kms: no KMS server endpoint provided")
		}
		endpoints, err := expandEndpoints(rawEndpoint)
		if err != nil {
			return nil, err
		}

		key, err := mtls.ParsePrivateKey(env.Get(EnvKMSAPIKey, ""))
		if err != nil {
			return nil, err
		}

		var rootCAs *x509.CertPool