Encryption with pgcrypto
There is no way to avoid the drawbacks of symmetric encryption on the server.

PostgreSQL has to have access to the key and the encrypted data to decrypt it if you want to "avoid having the application decrypt". There are only two sources that can do it.


the consumer
the database (in which case it's also subject to being written in a log file)


Of course, if you have a single access point to the data like an webserver or the like, you could potentially decrypt there too and keep the keys off the server.