if err != nil {
			return nil, crypto.ObjectKey{}, err
		}
	}
	return newEncryptReader(r.Context(), content, kind, keyID, key, bucket, object, metadata, ctx)
}

func decryptObjectMeta(key []byte, bucket, object string, metadata map[string]string) ([]byte, error) {
	switch kind, _ := crypto.IsEncrypted(metadata); kind {
	case crypto.S3:
		if GlobalKMS == nil {
			return nil, errKMSNotConfigured

			if len(baseKey) != 32 {
				return oi, crypto.ErrInvalidCustomerKey
			}
			objectEncryptionKey, err = decryptObjectMeta(baseKey, bucket, object, fi.Metadata)
			if err != nil {
				return oi, err
			}
		}
	case crypto.S3, crypto.S3KMS:
		objectEncryptionKey, err = decryptObjectMeta(nil, bucket, object, fi.Metadata)
		if err != nil {
			return oi, err
		}
	}