Secure postgresql database encryption
There have been no significant enhancements in pgcrypto, and there's no functionality to allow functions to be marked sensitive such that queries that use them don't get logged. That'd fill one security hole and create another anyway.

So long as you don't actually store the key in the DB, you're not inherently giving the DB the ability to decrypt the data. You're just increasing the risk of key exposure through logs, network protocol captures (if not SSL), pg_stat_activity, etc. If you trust both the DB server and app server, this may not actually matter as much. Nonetheless, I still think it's better that the DB never see the decryption keys at all.

See also:


https://stackoverflow.com/q/12614523/398670
https://stackoverflow.com/q/21095026/398670
https://stackoverflow.com/q/8054503/398670
https://stackoverflow.com/q/12329652/398670
https://stackoverflow.com/q/12329652/398670