Why encryption-at-rest doesn't protect your S3 bucket

SSE-S3 decrypts transparently on GetObject. If the bucket is publicly readable, encryption provides zero confidentiality. Here's the compound risk Stave catches.