Quotas can be raised by request but approval is not guaranteed, and GCP has lowered quotas without warning in the past KMS is not meant for unlimited keys → All variables are currently encrypted using the same KMS key, meaning a brute-force attack could compromise variables across all of Railway Envelope encryption is the practice of encrypting plaintext data — like variables — with a data encryption key (DEK), then encrypting the DEK with a key encryption key (KEK). → Using a separate data key per environment means that a brute-force attack of one environment won’t compromise data for any others More flexible encryption → While we don’t necessarily need to surpass the 64KiB KMS limit, the use of symmetric AES encryption means we can now encrypt data of any length