}

// Metrics returns a current snapshot of the KMS metrics.
func (k *KMS) Metrics(ctx context.Context) (*Metrics, error) {
	latency := make(map[time.Duration]uint64, len(k.latencyBuckets))
	for i, b := range k.latencyBuckets {
		latency[b] = k.latency[i].Load()
	}

	return &Metrics{
		ReqOK:   k.reqOK.Load(),
		ReqErr:  k.reqErr.Load(),
		ReqFail: k.reqFail.Load(),
		Latency: latency,
	}, nil

			DefaultKey: env.Get(EnvKMSDefaultKey, ""),
			conn: &kmsConn{
				enclave:    env.Get(EnvKMSEnclave, ""),
				defaultKey: env.Get(EnvKMSDefaultKey, ""),
				client:     client,
			},
			latencyBuckets: defaultLatencyBuckets,
			latency:        make([]atomic.Uint64, len(defaultLatencyBuckets)),
		}, nil
	case lookup(EnvKESEndpoint):
		rawEndpoint := env.Get(EnvKESEndpoint, "")
		if rawEndpoint == "" {

		return nil, errors.New("kms: invalid key length " + strconv.Itoa(len(key)))
	}
	return &KMS{
		Type:       Builtin,
		DefaultKey: keyID,
		conn: secretKey{
			keyID: keyID,
			key:   key,
		},
		latencyBuckets: defaultLatencyBuckets,
		latency:        make([]atomic.Uint64, len(defaultLatencyBuckets)),
	}, nil
}

// secretKey is a KMS implementation that derives new DEKs
// from a single key.
type secretKey struct {