Need to restrict decrypt powers to a Password Admin Role

[ghost]

I need a Role for password administration (let's call it PasswordAdmin) that has powers like the current Admin Role. I need the Admin and SysAdmin Roles to not be able to decrypt encrypted fields. They can delete encrypted parameters if need be. But can't see encrypted parameter values. The result is that the PasswordAdmin Role is the only Role that has decrypt powers.