I realize it's very hard, but can we maybe reconsider opening the encryption-at-rest feature request? https://github.com/immich-app/immich/issues/450

Maybe we can give temporary access to processing steps in the pipeline, then have Immich forget the keys after it does the processing?