What is the point of ENABLECLIENTENCRYPTKEY option?

[Mita201]

Hi,
I am wondering of what is the practical use of having backups encrypted on TSM server and let TSM server itself manage keys?
There is an option ENABLECLIENTENCRYPTKEY, that you can use with BA clients and API clients (it is only available option for ISP for Databases, SQL and Oracle) so backups are encrypted on client side, but backup and the keys resides on TSM server.
If I have encrypted backup I would like to have keys stored separately from backup, or at least passphrase for the key.
I see no point of having them "in same basket".
Anyone thinks differently?

 

[moon-buddy]

I don't want to worry about managing keys so I let TSM do it for me. No Key Manager system to install, manage, maintain, etc.

 

[Mita201]

But what is the point of client side encryption if it is completely transparent to a client? With BA client you may manage passphrase of the key, so one can't access backuped data without knowing it, on another "evil" node. With API clients and this option - encryption is completely pointless.