Escrow a KEK during backup creation.
Unique identifier for this recovery record
Identifier for the escrowed KEK
The plaintext KEK (will be encrypted by the vault)