"If you want Always Encrypted to protect the data all the way to the client's device, then you have to put the app that can decrypt the data on that...