I'm using encrypt/key/real_aes and lockr to create environment specific encryption profiles. Ie, prod data should never be accessible on UAT, dev, local etc.

What I'm wondering about is whether I can easily swap out field encryption profiles on specific environments, or if I can change the key being used by the environment?

Ultimately, I'd just like keys to be available to their environment only. Lockr helps by never displaying the key, but I can still request the prod key from lockr when on local, etc.

I'm not sure I can do these while keeping my site secure so I'm hoping for some best practice solutions to this.

Thanks.