When it comes to the second point, this have been addressed in SQL 2019 where there is a new feature Always Encrypted with Enclaves. An enclave is a proctect area in the CPU, which can receive the encryption keys from the client but still be out of reach.
Enclave support can be both hardware-based and software-based. I've only tried the latter, and the setup is a little complex.
Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se