A client computing system for keeping encrypted data tamper resistant, comprising: one or more processors; and one or more storage media having stored computer-executable instructions that are executable by the one or more processors for implementing a method for keeping encrypted data tamper resistant, the method comprising: associating a cluster of data with a unique key identifier; encrypting the cluster of data using an encryption key; sending the unique key identifier and a decryption key to a server that has access to a key ID database that stores the unique key identifier and the decryption key, wherein the decryption key is interrelated to the encryption key and configured to decrypt the cluster of data that is encrypted using the encryption key; storing the unique key identifier in the cluster of encrypted data as metadata without storing the encryption key; initiating boot of a client system; sending a communication request to a server that has access to the key ID database; receiving a communication response from the server; sending the unique key identifier to the server; receiving a decryption key from the server; and decrypting the cluster of encrypted data using the decryption key. one or more processors; and one or more storage media having stored computer-executable instructions that are executable by the one or more processors for implementing a method for keeping encrypted data tamper resistant, the method comprising: associating a cluster of data with a unique key identifier; encrypting the cluster of data using an encryption key; sending the unique key identifier and a decryption key to a server that has access to a key ID database that stores the unique key identifier and the decryption key, wherein the decryption key is interrelated to the encryption key and configured to decrypt the cluster of data that is encrypted using the encryption key; storing the unique key identifier in the cluster of encrypted data as metadata without storing the encryption key; initiating boot of a client system; sending a communication request to a server that has access to the key ID database; receiving a communication response from the server; sending the unique key identifier to the server; receiving a decryption key from the server; and decrypting the cluster of encrypted data using the decryption key. associating a cluster of data with a unique key identifier; encrypting the cluster of data using an encryption key; sending the unique key identifier and a decryption key to a server that has access to a key ID database that stores the unique key identifier and the decryption key, wherein the decryption key is interrelated to the encryption key and configured to decrypt the cluster of data that is encrypted using the encryption key; storing the unique key identifier in the cluster of encrypted data as metadata without storing the encryption key; initiating boot of a client system; sending a communication request to a server that has access to the key ID database; receiving a communication response from the server; sending the unique key identifier to the server; receiving a decryption key from the server; and decrypting the cluster of encrypted data using the decryption key.