I'm building the "in-use" part of this right now...what if you could encrypt your data with an encryption key (at-rest), but also to a set of code that is allowed to decrypt it (in-use). If that code is identified cryptographically, its identity can't be spoofed or stolen.

We're exploring secure enclaves as the protected runtime env and the code attestation generation: https://github.com/edgebitio/enclaver

This post has made me add pgsodium to my reading list :)