sum := computeEncryptionConfigHash([]byte(""))
	if expect != sum {
		t.Errorf("expected hash %q but got %q", expect, sum)
	}
}

func Test_kmsv2PluginProbe_rotateDEKOnKeyIDChange(t *testing.T) {
	defaultUseSeed := GetKDF()

	origNowFunc := envelopekmsv2.NowFunc
	now := origNowFunc() // freeze time
	t.Cleanup(func() { envelopekmsv2.NowFunc = origNowFunc })