On 20 Сер, 18:12, "FromTheRafters" erratic @nomail.afraid.org wrote:

I believe that the point there was that the field itself contained only a
hash, not actually a key. If I'm understanding it correctly, it is a hash
that identifies a certificate that contains a key needed to decrypt the key
needed to decrypt the data.

Not exactly. Certificate do not contain the private key by itself
(which is actually used to decrypt the FEK), but it has a reference to
it.