I'm using GCP bucket for storing the state. The bucket has a custom kms for encryption and each time when I run

pulumi up

is says

warning: Could not get signed url for stack location: blob (key ".pulumi/stacks/deploy.json") (code=Unknown): to use SignedURL, you must call OpenBucket with a valid Options.GoogleAccessID and exactly one of Options.PrivateKey or Options.SignBytes

Any idea why pulumi uses SignedURL for the state?

Mind opening an issue at https://github.com/pulumi/pulumi for this?