I think encrypt should be fine.  The [create_encrypted_datum](https://github.com/cloudkeep/barbican/blob/master/barbican/common/resources.py#L111) function takes care of creating the secret to datum relationship.  But now that you mention it maybe we need to move that function into the plugin manager?