Another way, would be to have like a multi tier setup:
CMOD -> WebService (which get the document from CMOD and encrypt it) -> Send the encrypted document to the S3 Project team
That way, you can have a simple ODWEK interface on you side, and give the data in the way you want to the other party.
And they don't need to know CMOD, you just encapsulate everything in your API.
That way, you can use bulk retrieve or single retrieve.
The problem with the exit, is that you cannot do bulk retrieve, and this could be really tricky, but not impossible, since people already did that.