Storing encryption keys on the same filesystem where the encryped data is located is not the most secure way of handling things but above all it is not a convenient way to enforce policies on key rotation or expiration. Making the key retrieval process generic enough that it can be extended to support multiple providers would make implementing them easier. For starters, the existing file-based encryption is the only one that is needed to verify that the encryption in the binlogrouter works.