Where is encryption and decryption done if I use SDKMS?