I've been reading multiple resources on SQL Server Encryption, and everyone does it basically the same way, but no one explains why we use asymmetric keys in SQL Server. And by this I mean when we follow "proper" procedure and encrypt data symmetrically first, followed by an asymmetric key or certificate as in this MSDN heirarchy:
So if I have data, first I encrypt it with a symmetric key for speed and avoidance of re-encryption if compromised. We then secure that key with a second-tier of encryption.
Now lets assume I secure the second key with a password. What advantage does a Certificate, Asymmetric Key, or Symmetric Key have in this scenario? It seems to me we never utilize the public aspect of a Certificate or Asymmetric key using this strategy since we are only using the decryption aspect. So shouldn't be be agnostic to which of the three methods we choose? We can revoke access to all three key types and grant permissions to use all three keys. Why not use another symmetric key?
The only difference I see here is that you can protect a Cert or Asym key with the DMK so users need not enter a password. This makes access easier at the expense of losing the security of forcing users to enter that second password.
Is this a correct understanding?