Transit Encryption

[gawsoftpl]

I would like to write new class for encrypt data via transit for example in Hashicorp Vault.
I'm wondering whether to write a new Backend class or KeyProvider class?

Solution 1 new backend class:
when execute encrypt, method will send request to vault server for encrypt data

Solution 2 new key provider class:
Store CIPHERSWEET_KEY as encrypted string by vault transit
when execute getSymetricKey method will send request to vault server for decrypt CIPHERSWEET_KEY

Which solution will be the best?