Got it working with getObject rather then getSignedUrl.

I think there is a valid point in not returning decrypted data with getSignedUrl method. Since using getSignedUrl, key would be passed in plain text in url rather then in header, which would then diminish the use of encryption if key is readable over network.

Following works with decrypted object in byte array:

    s3.getObject({
        Key: 'testfolder/abc.png',
        SSECustomerAlgorithm: 'AES256',
        SSECustomerKey: ssecKey
    }, function (err, data) {
        if (err) {
            console.error(err);
        }
        else {
            console.log('BYTE ARRAY: ' + data.Body);
            console.log('BASE64: ' + data.Body.toString('base64'));
        }
    });

According to the document at https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html#getSignedUrl-property:

Note:

Not all operation parameters are supported when using pre-signed URLs. Certain parameters, such as SSECustomerKey, ACL, Expires, ContentLength, or Tagging must be provided as headers when sending a request. If you are using pre-signed URLs to upload from a browser and need to use these fields, see createPresignedPost().

You would need code like these:

In backend:

AWS.config.update({
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  region: process.env.AWS_REGION,
  signatureVersion: 'v4' // NB! this seems needed to avoid some bugs
})
s3.getSignedUrl('getObject', {
      Bucket: process.env.S3_BUCKET_NAME,
      Key: key,
      SSECustomerAlgorithm: 'AES256', // NB! this must be added
    })

In browser:

//encryption key can be generated in nodejs:
//var password = "some easy to remember password";
//var encryption_key = crypto.createHash('sha256').update(password, 'utf8').digest('base64');
//var encryption_key_md5 = crypto.createHash('md5').update(encryption_key, 'base64').digest('base64');

function presigned_get(url) {
  console.log("presigned_get", url);
  var xhr = new XMLHttpRequest();
  xhr.responseType = 'blob';
  xhr.open("get", url);
  xhr.setRequestHeader("x-amz-server-side-encryption-customer-algorithm", "AES256");
  xhr.setRequestHeader("x-amz-server-side-encryption-customer-key", ENCRYPTION_KEY);
  //xhr.setRequestHeader("x-amz-server-side-encryption-customer-key-MD5", ENCRYPTION_KEY_MD5);
  xhr.send();
  xhr.onload = function() {
    if (xhr.status == 200) {
      console.log(`Downloaded ${url}`);
      var filename = url.substring(0, url.indexOf('?'));
      filename = filename.substring(filename.lastIndexOf('/')+1);
      window.saveAs(xhr.response, filename);
    } else {
      var reader = new FileReader();
      reader.readAsText(xhr.response);
      reader.addEventListener('loadend', (e) => {
        console.error(`Downloading ${url} failed:`, xhr.statusText, e.srcElement.result);
      });
    }
  }
}