Best practice on managing encryption keys for multiple instances on multiple servers

Hello; We are managing several Ensemble instances on several servers.  One server has 4 instances, and two other servers have one instance each (those are production servers).  We encrypt all instances using the Caché encryption in the management portal.

Currently we are using two different encryption keys: 1 key on the server with 4 instances, which is used for all 4 instances, and a second key on single-instance server. ( I'm installing the newest production server now.)

What I'd like to know is what are the best practices for managing encryption keys for separate servers. 

The options are to use a single key, across the network, for all instances.  The pros for this are if we remove an encryption administrator username, the user is removed from all instances; just one key is maintained and backed up.  The con is that the key will reside across the network (I haven't dones this yet).

The other option is to create a new key for each new server, and maintain each key's users separately.

Any thoughts on this?

One final question(s).  I'm using an installer manifest to install a new instance, and hope to use it to install new instances on new servers in the future.  I was hoping to add an EncryptionKeyID attribute to the <Namespace> <Configuration> so that the main namespace, when created by the installer, is encrypted with the encryption key.  However, this will depend on what key I decide to use.  Does this key need to be in place before I can configure a new namespace using the Installer manifest?  That is, do I need to isntall the instance first, set up the encryption key, and then run my installer manifest?

Is the Administration / Encryption / Manage Encryption Key File menu option in the management portal displayed differently on a LIVE system than on a DEVELOPMENT system?  My LIVE system does not display the KeyID in this area, although I can find the Key under the menu option Administration / Encryption / Database Encryption.

Thank you,

Laura