encrypted blobdecrypt key on create