In SQL Server 2019 the potential to use enclaves was added to Always Encrypted. An enclave is a secure partition of memory, in this case on the SQL Server machine, that appears as a black box to anything outside of the enclave. There is no way to view the data or code inside the enclave from outside of it, which makes it a trusted and secure environment in which to perform cryptographic operations. Code that runs in the enclave must also be signed and cannot be modified.
In looking at Always ...