I suppose at least if you

node_encrypt

something as soon as possible (ie in the profile), nothing can accidentally unwrap it further down the stack so to speak. But they're both quite difficult to work with. Support in modules is patchy. When using

node_encrypt

you've still got to remember to use

redact

too. Very easy to think you're protecting secrets when you're not etc.