ecryptfs could work great for applications with a little bit of magic to provide a C library which would mount a ecryptfs directory into the process's name space (using unshare(2)). Would need to figure out how to do key management though.. Not sure if there is a freedesktop.org standard yet..