Encrypted container, some kind of analogue to ASN.1-based CMS
EnvelopedData, LibrePGP or age.
=> CMS
=> LibrePGP
=> age

* Ability to use multiple recipients
* Either passphrase- or public-key based KEMs
* Hybrid PQ/T KEMs
* Ability to authenticate the sender
* Optionally anonymous recipients and sender
* Streaming friendly
* Ability to parallelise encryption/decryption procedures
* Current DEM schemes do explicit key commitment
* Current DEM schemes use key ratcheting and rotation
* Ability to safely encrypt to multiple recipients

Stored in a file, it should begin with "cm/encrypted" [encoding/MAGIC].

    encrypted {
        {field . {map}}
        {field dem {with dem}}
        {field kem {list} {of kem} >0}
        {field id {hexlet} optional}
        {field payload {bin} optional}
        {field pubs {list} {of type map} optional >0} {# attached public keys}
    }
    
    dem {
        {field . {map}}
        {field a {str} >0} {# xchapoly-krkc}
                           {# xchacha-krmr}
                           {# kuznechik-ctr-hmac-kr}
    }
    
    kem {
        {field . {map}}
        {field a {str} >0}
        {field cek {bin} >0}
    }
    
    schema-include fpr.tcl
    schema-include kem-with-encap.tcl
    schema-include kem-gost3410-hkdf.tcl
    schema-include kem-balloon-blake2b-hkdf.tcl
    schema-include kem-pbkdf2.tcl

"/payload" contains the ciphertext. It is encrypted with random "content
encryption key" (CEK) with an algorithm specified in "/dem/a" (data
encapsulation mechanism). "/dem" may contain additional fields
supplementing the decryption process, like initialisation vector.

If "/payload" is absent, then ciphertext is provided by other means, for
example just by following the "cm/encrypted" structure. It is recommended
to encode it as a BLOB, which chunk's length depends on DEM algorithm.

CEK is encapsulated in "/kem/*/cek" entries (key encapsulation
mechanisms), using "/kem/*/a" algorithm.

If KEM uses public-key based cryptography, then recipient's
[cm/pub/]lic key(s) must be provided. Optional "/kem/*/to", public key's
fingerprint, may provide a hint to quickly search for the key on the
recipient's side.

Optional "/id" is used in KEMs for domain separation and envelope
identification. UUIDv4 is recommended.
If absent, then null UUID is used in KDF.

[cm/encrypted/authcrypt] -- authenticated public-key encryption
[cm/keywrap/] | key wrapping mechanisms
[cm/dem/]     | data encapsulation mechanisms
[cm/kem/]     | key encapsulation mechanisms