CKM: Prepare db & keys once per encryption group