A client side key sounds great, let me investigate this route and see how to do this. I imagine it's a similar pattern to end to end encryption.