Encrypt realm data with dek which is encrypted with kek. The signing keys are also encrypted with the kek.

IdentityShroud.Core/Services/RealmService.cs

@@ -58,6 +58,12 @@ public class RealmService(
             .Query()
             .Where(k => k.RevokedAt == null)
             .LoadAsync();
-        
+    }
+
+    public async Task LoadDeks(Realm realm)
+    {
+        await db.Entry(realm).Collection(r => r.Deks)
+            .Query()
+            .LoadAsync();
     }
 }