An apparatus comprises a storage system and a cryptographic module incorporated in or otherwise associated with the storage system. The cryptographic module is configured to obtain a plurality of data encryption keys used to encrypt respective ones of the data items for storage in the storage system...