Quick note for you, I mentioned the cert decryption problem in a different DPAPI thread and MS says it's fixed in 2.1.0. https://github.com/aspnet/DataProtection/pull/299