Where is encryption and decryption done if I use Self-Defending KMS?