encrypted blobdecrypt key stored in db and fixed signature on recov