docs: clarify layered SSE-C key authentication

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/encryption-v1.go

@@ -356,9 +356,9 @@ func rotateKey(ctx context.Context, oldKey []byte, newKeyID string, newKey []byt
 }
 
 // checkSSECCopySourceKey authenticates the SSE-C copy source key against the
-// sealed object key held in metadata. GetObjectNInfo builds no decryptor for a
-// zero byte object, so a copy whose data path never decrypts anything has to
-// verify the source key explicitly. Mirrors the errors rotateKey reports.
+// sealed object key held in metadata. This keeps the diverted rotation safe on
+// its own and remains defense in depth when the read path also authenticates
+// zero-byte objects. Mirrors the errors rotateKey reports.
 func checkSSECCopySourceKey(h http.Header, metadata map[string]string, bucket, object string, newKey []byte) error {
 	oldKey, err := ParseSSECopyCustomerRequest(h, metadata)
 	if err != nil {