RFC: encryption at rest

This is the initial RFC for encryption at rest.

The `Security considerations` sections must be expanded and carefully
examined.

The `Unresolved questions` must be resolved.

The `Future improvements` must be examined for in/out-of scope
decisions.

Author: marc