We have some web parts that expect database connection strings to be
defined in the app's web.config. Instead of manually updating all the
web.config files spread across our farm, I'd like to create a single
administrative settings page that collects the required configuration
information and uses the sharepoint WebConfigModifications API to push
the changes out automatically.

What complicates matters is that it's recommended practice to encrypt
the contents of these particular sections using one of several
standard Protected Configuration Providers. Unfortunately the standard
providers seem to expect machine-specific information (e.g. keys in
machine.config), so I can't define a single section that will work on
all the WFEs. I could in theory write a custom PCP which uses some
farm-wide information, but that's starting to approach Real Work (as
then I have to build something to update *that* shared information...)

Has anyone encountered this kind of thing before? Any suggestions for
alternative places to manage (and protect) configuration information
that should *not* be included in the .webpart definition?