We derive specific keys:
enc_key_attributes = KDF(master_key, "ATTR_V1")
enc_key_documents = KDF(master_key, "DOCS_V1")
enc_key_metadata = KDF(master_key, "META_V1")
Each dataset gets its own key.
Rotation = versioning the label (e.g. ATTR_V2 → ATTR_V3).