title: actual data encryption key is used to encrypt PV in GKE
body: <p>In GKE cluster, I get to encrypt a dynamically provisioned PV using customer supplied key (using Cloud KMS).
  I specify KMS resource name in storage class, and create PVC out of this.</p>
  <p>It is unclear to me, which key is used to encrypt data in PV.
  Is it directly using the key that I specify in storage class, or <em>another</em> data encryption key (which in turn is encrypted using specified key in KMS - aka envelope encryption)?</p>