For an API call that requires decrypting data it can add about 5-10ms, most of that comes from reading the values from the token database. Encrypting will incur a similar performance penalty (again from the database).

The core pieces (API Proxy, Encryption Service, secure/general infrastructure divide) we're done by me in the first 2-4 months.

We now have a team of three (myself included) who maintain those systems (among many other responsibilities).

Productive this and sell it at a low cost if it’s that simple. I’d love to use something like this but building it from scratch in house is cost prohibitive.