Most systems never found a good way to encrypt data at rest.
You either have to let the user manage the keys / passphrase, giving up things like search and password recovery, or you have to manage the keys in a service, which doesn't provide privacy from the service that manages the keys.
You either have to let the user manage the keys / passphrase, giving up things like search and password recovery, or you have to manage the keys in a service, which doesn't provide privacy from the service that manages the keys.