The usual reason for doing this is to convince auditors or lawyers that the system is in compliance with GDPR or similar legislation, not to resist the attentio

The usual reason for doing this is to convince auditors or lawyers that the system is in compliance with GDPR or similar legislation, not to resist the attention of three letter agencies. If you can say you’re using industry standard / government approved crypto it should be fine.