This looks interesting, thanks for posting it. Seems odd it only encrypts some records, is this for performance reasons I wonder?