Can someone help me understand this recommendation:

Under symmetric encryption, the authors write:

> If you are in a position to use a key management system (KMS), then you should use KMS. If you are not in a position to use KMS, then you should use authenticated encryption with associated data (AEAD).

These seem orthogonal to me. KMS := how keys are generated and distributed to communication partners. AEAD := how data is encrypted between communication partners using those keys.

How can it be “use a KMS if you can _or else_ use AEAD”? Shouldn’t it be “and”? What am I missing?