const string AkvPath = "...";
var keyVaultProvider = new SqlColumnEncryptionAzureKeyVaultProvider(new DefaultAzureCredential(true));
var signedCMKM = keyVaultProvider.SignColumnMasterKeyMetadata(AkvPath, false);
var verifiedMetadata = keyVaultProvider.VerifyColumnMasterKeyMetadata(AkvPath, false, signedCMKM);

if (!verifiedMetadata)
    throw new Exception("Signed CMK metadata does not match.");

var cek = new byte[32];
var encryptedCek = keyVaultProvider.EncryptColumnEncryptionKey(AkvPath, "RSA-OAEP", cek);
var decryptedCek = keyVaultProvider.DecryptColumnEncryptionKey(AkvPath, "RSA-OAEP", encryptedCek);

if (!decryptedCek.SequenceEqual(cek))
    throw new Exception("Column encryption key does not roundtrip.");