When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and the confused deputy problem doesn't apply either. To be clear, the plaintext the DEK ultimately encrypts should be protected with AEAD. But, if you would argue the DEK itself needs AEAD please tell me why.
Here are some resources to use as a reference for how major cloud platforms recommend using their key managements systems to encrypt data.