It would be nice if S3EncryptionClient transparently extended the boto client and preserved the boto API. get_object returns a different response than the boto client, there is no support for head_object etc... This is all despite the fact that I can pass a real boto s3 client into the constructor. I'd be willing to work on this if its of interest.