generate per-note keys on the fly and encrypt them with master-key