docs: ContentCryptoMaterial recreate(EncryptionMaterials newKEK,
                                     EncryptionMaterialsAccessor accessor, S3CryptoScheme targetScheme,
                                     CryptoConfiguration config, AWSKMS kms, AmazonWebServiceRequest req) {
          if (!usesKMSKey()
              &&  newKEK.getMaterialsDescription().equals(kekMaterialsDescription)) {
              throw new SecurityException(
                  "Material description of the new KEK must differ from the current one");
          }
          final EncryptionMaterials origKEK;
          if (usesKMSKey()) {
              origKEK = new KMSEncryptionMaterials(kekMaterialsDescription.get(
                  KMSEncryptionMaterials.CUSTOMER_MASTER_KEY_ID));
          } else {
              origKEK = accessor.getEncryptionMaterials(kekMaterialsDescription);
          }
          SecretKey cek = cek(encryptedCEK, keyWrappingAlgorithm, origKEK, config.getCryptoProvider(),
                              getContentCryptoScheme(), kms);
          ContentCryptoMaterial output =
              create(cek, cipherLite.getIV(), newKEK,
                     getContentCryptoScheme(),  // must use same content crypto scheme
                     targetScheme, // target scheme used to recreate the content crypto material
                     config, kms, req);
          if (Arrays.equals(output.encryptedCEK, encryptedCEK)) {
              throw new SecurityException(
                  "The new KEK must differ from the original");
          }
          return output;
      }