I wonder, why would you want DB-managed encryption instead of just putting its storage directory in a LUKS-encrypted volume?