padrino-framework | Padrino is a full-stack ruby framework built upon Sinatra | Firewall library

The communications between your client and Google are secured via TLS. You can see in Wireshark that the communications are on port 443 and that a TLS connection is negotiated.

Your requests are authenticated using OAuth. In this case (using a service account from outside of GCP), this is done using the flow documented in Using OAuth 2.0 for Server to Server Applications:

• you are responsible for provisioning your off-GCP app with the private key issued to the service account you wish to assert;
• it then uses that private key to sign a JWT and submit it to Google's OAuth server;
• Google replies with an OAuth access token which is a bearer credential which identifies the service account in question;
• You then provide that access token with your requests to KMS to identify the entity making the requests as the service account and using its authority;
• KMS and GCP then use that identity to evaluate IAM access controls to determine whether particular operations are authorized.

This is secured end-to-end (the TLS connection is end-to-end security since the parties to the communication—your service and Google—are the TLS endpoints). Since your question seems to be "are these requests secure in transit, and how can I show this", I think it's sufficient to show that a TLS connection is being negotiated, Wireshark should be able to show you this. (Your connection library also needs to be doing a suitable PKI evaluation of the presented certificate; validating that this is taking place correctly is a little more involved, but it's a reasonable thing to trust is happening correctly if you investigate the tools you're using and their assertions around certificate validation).

Best wishes and thanks for using GCP and Cloud KMS. Let us know if you have any further questions.