This is basically how Fireproof works: files to S3, reads from any cache, encryption metadata in your session store. All of this becomes “easy” if you write a storage engine from scratch for immutable content addressed data.