There are many options introduced both by Percona and MySQL that uses Master Key encryption. Although online conversion from MK encryption to Keyring encryption is possible - there is no way of going from Keyring encryption to MK encryption without alter (offline encryption). This might be a problem for system tablespaces and need to be consider. Also possibly all MK encryption options inherited from 5.7 (system tablespace encryption) should be disable for online keyring re-encryption to work. This needs to be designed carefully.