What is the Encrypting On-Chain Data pattern, and why is key management its Achilles' heel?

Encrypt confidential data before writing it to the chain so the publicly visible bytes are useless without the key — but because the chain is immutable and keys must be shared off-chain, a leaked or lost key is catastrophic and access can never be truly revoked.

• Problem. On a public chain every participant can read all transactions (needed to validate them), so commercially sensitive data can't be stored in plain form.
• Solution. Symmetrically or asymmetrically encrypt data before inserting it. To share among several parties, one participant generates a secret key and distributes it during an initial key exchange; data is symmetrically encrypted with that key, and only holders can decrypt.
• Benefit. Confidentiality — the on-chain ciphertext is useless without the key.
• Drawbacks (all rooted in immutability). Compromised key (encryption pushes the hard problem to off-chain key management; a leaked key exposes everything). No access revocation (the ciphertext lives forever, so anyone who ever held the key keeps access forever). Immutable data (ciphertext stays on-chain permanently and may fall to future brute-force or quantum attacks). Key sharing (the key must travel off-chain — sending it through the chain would make it public).