the point of encrypting data at rest is that it means that an attacker has to exfiltrate two things rather than one. And for homegrown workflows that end up with copies of the catalog on other nodes (eg on a shared filesystem or the like), they're not trivially decryptable.