encryption is easy, key management is hard
expressioncryptography
The crypto veteran's summary: encrypting data is the easy part; protecting, rotating, and not losing the keys is the hard part.
The algorithms are free and vetted; what fails in practice is the key left in a repository, the certificate nobody renewed, the HSM nobody can operate. It is the two-hard-things joke of the crypto world, and the reason key-management systems exist.
Key management is the part of cryptography that actually fails. The algorithms are the well-understood component, extensively reviewed and rarely broken in deployment; what breaks is generating keys with poor entropy, storing them in a repository, distributing them over a channel that is not itself protected, failing to rotate them, and having no procedure for revocation.
The recursion is what makes it hard rather than merely tedious. Protecting a key requires another key, and protecting that one requires another, and the chain has to terminate somewhere in a hardware root, a passphrase in a person's memory, or an institutional procedure. Every real system resolves that regress by putting trust in something non-cryptographic, and where it terminates is the actual security boundary.
The operational consequence is that the interesting questions are procedural. Who can access the key, how would you know if they did, what happens when the person who set it up leaves, and can you actually revoke it in an emergency or is that a documented intention nobody has tested. Those questions are answerable, and a system with strong algorithms and unanswered key management questions is not protected by the algorithms.