Save encryption details to kek_metadata, not datum.mime_type.