I need to clone an SE2 PDB from OCI to on-prem

Summary:

OCI requires that all tablespaces are TDE encrypted, even SE2 DBs. On-prem, you can't use TDE. Well, in fact, you can: all the ADMINISTER KEY MANAGEMENT commands work so you can create and open a wallet. You can then clone the encrypted PDB from OCI, open it and use the tables. But you can't decrypt the tablespaces, that hits ORA-00439. And I cannot decrypt on the OCI side before cloning, no matter what you do with encrypt_new_tablespaces and tablespace_encryption I get an ora-28427. Is there a way around this? It seems a perfectly reasonable requirement. I do have a TAR