In the driver spec we've decided we want to make a best-effort to store decrypted key material securely in memory. In libmongocrypt, we can store cached decrypted key material in buffers allocated securely (i.e. don't get paged to disk and are zeroed out when freed). We have server code that already does this apparently.