The first wall a developer learning encryption hits is not the algorithm itself, but the question "where do I put the key?". Encrypting data with AES-256 takes one line of code, but the moment you try to decide where to store that 256-bit key, everything gets complicated. Hardcode it in code and it lives in git forever. Put it in an environment variable and it leaks on process dump. Put it in a file and then who guards that file? The old security industry saying rings true here: "the real problem with encryption is not encryption, but key management." AWS KMS (Key Management Service) solves this "key must never be exported in plaintext" problem with a single design principle.