I am the maintainer of fnox. This is only true if you use the encryption providers. If you don't, nothing is encrypted obviously.

Your doc also doesn't seem to take into account my preferred way of using it with KMS that solves a lot of the problems mentioned.

[flagged]