[deprave]

Encryption at Rest makes it easy to reason about data hygiene, since access to the data is gated through access to the keys.

You want to delete data? Toss the keys. You want to confidentially process data? Make the keys available to a TEE or such. You want to prevent yourself from having constant access to the data? Let the client provide the keys. And of course, you want to protect the keys? Use an HSM.