Did you already perform a threat analysis and a risk assessment?
Who are you defending against? Which are the attack or data breach scenarioes?
Put them in a impact / likelihood matrix and defend against the most serious combinations.
Do you still need to encrypt live data in the db?
If positive, an approach I used in the past was to never perform any operation in the server. Users were storing their private key in the browser (local storage) and decrypt data on the fly in JavaScript (you have to trust the browser js engine bugs.) The server could generate and store data for them using the public keys but nothing more.
If you need server side aggregations you can store in cleartext site parts of the encrypted information. Example: city names give you users per cities, regions states, countries.
Be careful about reidentification using extra information attackers could know about your system and users.