A separate database/vault for user encryption keys is also useful for backups. This way you can delete (well make it un-decryptable) user data individually on cold storage. Known as https://en.wikipedia.org/wiki/Crypto-shredding