externalize encryption key