Nice article! Did you run into challenges using a DNS record for cut-over from the old DB to the new, encrypted DB?