Balloon-BLAKE2b + HKDF KEM.
=> Balloon
=> RFC 7693, BLAKE2b
=> RFC 5869, HKDF

    H = BLAKE2b
    KEK = HKDF-Expand(H,
        prk=Balloon(H, passphrase, /kem/salt, s, t, p),
        info="cm/encrypted/balloon-blake2b-hkdf" || /id)

"/kem/*/cek-wrap" is wrapped with [cm/keywrap/xchapoly] mechanism.