Meaningful diffs? How?

[isavcic]

The documentation says:

diffs are meaningful. If a single value of a file is modified, only that value will show up in the diff. The diff is still limited to only showing encrypted data, but that information is already more granular that indicating that an entire file has changed.

But that is the opposite of:

When sops creates a file, it generates a random 256 bit data key and asks each KMS and PGP master key to encrypt the data key. The encrypted version of the data key is stored in the sops metadata under sops.kms and sops.pgp.

When you decrypt a file, edit it, and encrypt it back again, all the values change because a different 256-bit data key is generated. Am I missing something in the workflow so that the former becomes true? I know that you can have a decrypted-diff, but the former depicts a granular, encrypted YAML diff, for example. Thanks.

[isavcic]

Strike that, data key is not changed if sops is used to "directly" edit by invoking $EDITOR, but some additional values do get changed, not sure if YAML gets parsed differently somehow...