What do we need `NONE` for, actually? Could we use `null` for that instead? After all, `NONE` isn't what comes **back** from S3 (if I'm understanding this correctly) if there is no encryption - the header simply isn't present, so getFirstHeaderOrNull returns `null`.