[chef-dev] How Secure is an encrypted data bag, really?

[Bryan Taylor < >]

If an attacker gains access to the chef server, can they not alter cookbook code that chef clients eventually run to obtain the data bag decryption keys this way?  Is there any protection against this? If not, are there still scenarios where the encryption does add value?