Working 2.11, which means we need to be able to *encrypt* under CBC too. Starting to work on that now.