Can't we do it similarly to the pg implementation? (decrypt in the query and compare against that)