[ameliaquining]

It seems to be how it's typically handled in practice. Example: https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-...

[IncRnd]

I understand your point, but a close reading of the dropbox article shows a qualified pepper they term "global pepper."