On top of aes-gcm. We have this in other codebases, it should be migrated here so we have a single correct version.