First pass at supporting NameID encryption