what is a   dumb   key allocator in your understanding  there is a fixed key key manager that is used by cinder volume encryption  is that anything like what you have in mind  lack of a key manager capable of providing unique keys was exactly the reason the patch was blocked in icehouse  so i do not know how much a   dumb   key allocator would assuage those reviewers  joe gordon wrote the blueprint states  this feature makes it harder for an attacker to read vm disks  since it encrypts each one with a unique key that is not stored locally  i do not see any in trunk key manager that supports this  