Nice question that should have been easy.

Should have read it slower I guess.

You create and store the Certificates in master.

You have to be connected to the CRM to USE the certificate to protect the DEK.