Function derive_key 

pub async fn derive_key(
    variant: AesVariant,
    input: &DeriveInput,
    options: AeadKeyOptions,
) -> Result<Aead, Error>

Mint an AES-GCM key of the declared variant from a parameterized derivation: the derivation runs at the variant’s key length and the result is subject to import_key_raw’s contract.

Requires the input’s derive_key grant — and, for an extractable key, derive_bits too; refusals fail Error::NotPermitted.