Looking at this closely, we should probably use the underlying keyVaultClient to determine if a client has been disconnected or not. mongo.ClientEncryption appears to just wrap mongo.Client. So instead of adding a closed bool, we can check if a connection has ended by seeing if the pointer to the pool has been nullified. For example:

func (ce *ClientEncryption) AddKeyAltName(ctx context.Context, id bson.Binary, keyAltName string) *SingleResult {
	if ce.keyVaultClient.sessionPool == nil {
		return &SingleResult{err: ErrClientDisconnected}
	}
}

Additionally, we only want to apply this to methods that actually use either keyValueClient or keyVaultColl (which is constructed from the client).

You can update the unit tests in 1 of 2 ways:

1. Keep a purely mocked solution:

ce := &ClientEncryption{keyVaultClient: &Client{}}

2. Actually connect to a client and then disconnect (it doesn't even matter if a server is live):

client, _ := Connect(options.Client().ApplyURI("mongodb://invalid"))
_ = client.Disconnect(context.Background())

ce := &ClientEncryption{keyVaultClient: client}

// [...]

The latter is probably better coverage.

LGTM w/ one small suggestion!

Great job! 🌟