>>ALL data? How are you supposed to query against it then? What does "at rest" even mean in the context of an always-on database? An encrypted partition or something?

Most database encryption is "transparent", meaning the applications won't even be aware that their database is encrypted. Here is an example:

https://docs.microsoft.com/en-us/sql/relational-databases/se...