System-managed encryption