oh, for specific documents. and you want to use something that can't be correlated. so, a seed, instead of an explicit key, combined with a pre-arranged concatenated path string would be simpller and more effective because it can be carried in one message.

A regular ephemeral key works in this solution, simpler UI. User doesn't have to know, even though their device or their account keys are encrypting the document keys.