nested key support, ignores unecrypted values