unwrap_dek_raw(
slots,ed25519_seed,ed25519_pk) ->dek_raw,err
Unwrap a DEK as raw bytes for key management operations
Same as unwrap_dek but returns the raw 32-byte DEK string instead of
a secure userdata. Used only for key management (adding new key slots
requires the plaintext DEK to re-wrap for a new recipient).