Should we have an allowlist for kases?

[elizabethhealy]

Allowlists protect against malicious files -- someone could edit the KAO in the manifest to point to a malicious kas url. The sdk would pass an access token to that url that could possibly be used maliciously to decrypt tdfs.

Allowlists require the client/pep to know and provide all possible kases on initialization -- With key splits this can get tedious as there could be many kases and possibly kases that are unknown/hidden to the user.

[jentfoo]

Moving risk discussion to Jira: https://virtru.atlassian.net/browse/VULN-35