There is a new cdap-kms-<version>.jar that is used when somebody sets security.store.provider to 'kms' in their cdap-site.xml
The CSD does not contain this jar, which results in errors like:
WARN [Endure-Service-:c.c.c.s.g.SecureStoreModules$StoreProvider@98] - Could not find classes required for supporting KMS based secure store
when the cdap master starts up. The secure store APIs also will not work without the jar.