boto3 Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4

#!/usr/bin/env python
import boto3
from botocore.client import Config
s3_client = boto3.client('s3', config=Config(signature_version='s3v4'))
s3_client.download_file('testtesttest', 'test.txt', '/tmp/test.txt')