There's a point, because if your sysadmin is competent, having access to the database of a webapp (webapp break-in) is much easier than being able to dump the s

There's a point, because if your sysadmin is competent, having access to the database of a webapp (webapp break-in) is much easier than being able to dump the server memory (OS break-in). You can go hardware with a cryptographic accelerator PCI card (good luck integrating that in your webapp)