I think we should compare against the verbatim string "aws-crypto-public-key" here, without the backticks.

After changing this line to the following, I was able to successfully run the upstream test in (test_encrypt_via_aws_encryption_sdk) that is currently disabled:

            if key != "aws-crypto-public-key":

nit: As a general note, we usually configure string constants like this one at the global scope of the module - this can help improve readability and reduce duplication, and can also facilitate monkey patching more easily (e.g., for testing, or if the logic needs to be extended from -ext, etc). 👍

I'd suggest that we define a global variable like IGNORED_CONTEXT_KEYS (somewhere at the top of this file), and then use it as follows:

# list of key names that should be skipped when serializing the encryption context
IGNORED_CONTEXT_KEYS = ["aws-crypto-public-key"]
...

def _serialize_encryption_context(...) ...:
    if encryption_context:
        aad = io.BytesIO()
        for key, value in sorted(encryption_context.items(), key=lambda x: x[0]):
            # remove ignored context keys from additional authentication data
            if key in IGNORED_CONTEXT_KEYS:
                continue
            ...

Thanks for the detailed review @whummer 🙏🙂 Doing the restructure and pushing it back again.
Regarding backticks: My bad, I mistakenly added it in the defaults.py of aws_encryption_sdk and therefore in models.py as well, I am correcting this also.