Most likely they wanted to use the same scheme everywhere in the webapp, and for some reason decided that encrypted data proxied through the user was the best c

Most likely they wanted to use the same scheme everywhere in the webapp, and for some reason decided that encrypted data proxied through the user was the best choice. Assuming that the concept in general is sane, then it makes sense to not special case specific uses (less code where things can go wrong).