Full support for *head* context encryption

Note: still missing full Cluster encryption!