You have a use case where the encryption must happen outside of AWS by user who can't call the KMS API. What Key Type (Symmetric or Asymmetric) will you use?