don't forget to free `encKeyNode` if encryption fails