Balloon-BLAKE2b + HKDF KEM.
=> https://crypto.stanford.edu/balloon/ Balloon
=> https://datatracker.ietf.org/doc/html/rfc7693.html RFC 7693, BLAKE2b
=> https://datatracker.ietf.org/doc/html/rfc5869.html RFC 5869, HKDF

<<    [schemas/kem-balloon-blake2b-hkdf.tcl]

    H = BLAKE2b
    KEK = HKDF-Expand(H,
        prk=Balloon(H, passphrase, /kem/salt, s, t, p),
        info="cm/encrypted/balloon-blake2b-hkdf" || /id)

"/kem/*/cek" is wrapped with [cm/keywrap/xchapoly] mechanism.
