Interface SealedAttachment

The encrypted attachment. Upload these bytes verbatim.

There is no key in here and nothing to protect beyond the ordinary care an upload deserves: the key that opens it is SealedAttachment.secret.

Opaque. Keep it, send it to whoever may read the file, and hand it back to decryptAttachment unchanged.

It contains the key that decrypts the file. It is deliberately a string rather than a structure, because you have no reason to read it: put it where the event referencing the attachment goes, which is inside the conversation's own encryption, and nowhere else.