Enveloppe encryption (what you are describing) is absolutely the way to go, but the caveats described in the document for key generation and symmetric encryption apply.