Does ASP.NET Core Data Protection call IXmlDecryptor.Decrypt on every request?

Question

We're using the Azure.Extensions.AspNetCore.DataProtection.Blobs and Azure.Extensions.AspNetCore.DataProtection.Keys packages for Data Protection, and our app seems to be making a LOT of requests to Azure KeyVault. I've tried spelunking through the ASP.NET Core code but it's difficult to follow.

Does the Data Protection feature make a call to IXmlDecryptor.Decrypt every time a Key is used (e.g. every time a cookie is deserialized) or is the decrypted key cached somewhere? Because the AzureKeyVaultXmlDecryptor implementation makes a request to KeyVault every time it's called, which could incur a lot of costs if it's happening on every single request.