Spy-proof enterprise encryption is possible, but daunting