Hi,
You can enable encryption-at-rest (tape encryption) via either your Scalar i2k or via DP, but I'm not clear on the licenses required for the Scalar i2k.
You'll need an Encryption LTU per server. You might have misunderstood the DP functionality of DP encryption - here's an excerpt from the Concepts Guide:
How Data Protector drive-based encryption works
The BSM reads the backup specification in which the Drive-based encryption option is selected
and requests an active encryption key from the KMS. The key is transferred to the Media Agent
(MA), which configures the drive for encryption and sets the encryption key into the drive. The
drive encrypts both the data and the metadata that is written to the medium.
In an object copy or object consolidation operation from an encrypted backup, the data is decrypted
by the source drives, transferred over the network and encrypted by the destination drives.
