Add a discriminator so that DataProtection doesn't use the same subkey across apps by default