This can be solved, or at least mitigated, using the ncryptsec. More client should support it.