I think AC is, like Zimmerman above, talking mostly about the data-at-rest case when it refers to key management being the riskiest part. This is reasonable, because in the data-at-rest case, all cryptography does is replace a large secret (the plaintext you want to protect) with a small secret (the key you need to protect instead). If you already had a keeping-something-a-secret problem, then it's reasonable to presume that you will have almost as much of a problem keeping the key a secret.