I'll definitely look into that, but "PL that takes the encrypted code, decrypts it, and passes it to plpgsql, you can do it" at first sounds easier to maintain
Out of curiosity (having never used them), how does Oracle handle the key for the encrypted code?
