encrypt metadata too