Four things. A hash chain so you know the file wasn't touched in transit. A byte-level check so you know what the file actually is, not what it claims to be. An access log that survives an audit. And a key-rotation story so old secrets don't outlive their usefulness.
Then I looked at what the platform already had. The primitives were sitting there: native, audited, already provisioned. The SDK was solving a problem the platform had already solved.
So I didn't reach for it. Not on principle. I don't carry a blanket rule against third-party. Because I couldn't prove the platform fell short. That's the actual threshold: prove the gap first. Native-first isn't a philosophy, it's just the cheaper, safer default. And in healthcare, the safer default is the only one worth defending.