A developer is designing an Android app that must work offline first and sync encrypted health data to a backend when connectivity is available. Which storage architecture satisfies both offline-first and encryption-at-rest requirements?

• A.A) Store data in AsyncStorage with periodic encryption using AES before sync
• B.B) Use SQLCipher (or Room with an encrypted storage implementation) for the local database with the encryption key in the Android Keystore; encrypt the sync payload with the server's public key or a session key before transmission over HTTPS
• C.C) Store all data in Android SharedPreferences with MODE_PRIVATE; encrypt using the user's email as a key derivation input
• D.D) Use the external storage /sdcard/Android/data/ directory with a custom file header flag indicating sensitive content