Support encrypted data bags

continuing mb-dev's work