Always ciphertext.
Lock it down.