If I'm only using a session ID with no extra data, encrypting it doesn't buy me anything. Is there a way to turn off encryption? I'd rather not waste the clock cycles if I don't have to.

I'll be storing session ID hashes on the server, no keys. That way should someone breach the server, they'll be forced to muck with the server and risk detection and not also have the option of silently spoofing users of their choosing.

I'll be happy to trust keys when I can keep them in an HSM. Thanks!