A data key encrypts the blob locally, and the same key decrypts the blob locally. The transit secrets engine in Vault is designed specifically for encrypting and decrypting data without storing the data. It provides encryption-as-a-service, which means it offloads the encryption workloads but does not temporarily or permanently store the data. Therefore, option A correctly describes the operation of the transit engine for encrypting and decrypting the blob locally using a data key.