move metadata encryption to worker