You answered yourself, I believe (see below). Using the SEND_KEY policy to true on both writes and reads does the trick. The comes with the cost of storing the Key as a hidden bin with the record.
That said, remember that you can access records directly with the digest, even if you don’t have the userKey. So even if you don’t know the key, and get back a bunch of digests from a scan/query, you can then get or batch-read those records by the digests.