Whenever you do a series of translations, you must invert them.
Short Answer. No.
As a managed packaged, you will need access to the encryption key to encrypt/decrypt data whatever the use case be. Once a subscriber access is given, the logged in user (the developer) will also have access to the protected settings and the debug logs, where the key is visible.
There are some best practices that you can ...
Encryption occurs between the browser and the server with HTTPS. Only the browser and the server are able to see this information. Try using something like WireShark to see what the data looks like when being sent over the Internet. The browser knows what the data is in the form, because it was the one to encrypt and send this data in the first place.