code: def update(self, identifier, new_instance):
          
          old_instance = self.retrieve(identifier)
          old_encrypted_identifier = old_instance.encrypted_identifier
  
          if (
              new_instance.encryption_context_key and
              old_instance.encryption_context_key != new_instance.encryption_context_key
          ):
              raise ValueError("Cannot change encryption context key")
  
          # If updating a non encrypted field - skip
          if new_instance.plaintext is None and new_instance.encrypted_relationship is None:
              result = super().update(identifier, new_instance)
              self.expunge(result)
              return result
  
          # Verify that the new instance is encrypted if it should be
          # If it's not - encrypt it with the old key
          # If it is - save the expected new plaintext
          if new_instance.plaintext is not None:
              expected_new_plaintext = new_instance.plaintext
              new_instance = self.reencrypt_instance(new_instance, old_instance.encryption_context_key)
          else:
              decrypt, expected_new_plaintext = decrypt_instance(new_instance)
  
          result = super().update(identifier, new_instance)
  
          # Delete the old encrypted value (instead of using sqlalchemy cascade)
          if old_encrypted_identifier != new_instance.encrypted_identifier:
              self.encrypted_store.delete(old_encrypted_identifier)
  
          # Update the return result, super().update() won't do it.
          self.expunge(result)
          result.plaintext = expected_new_plaintext
          return result
docs: Update an encryptable field, make sure that:
          * We won't change the encryption context key
          * The new value is going to be encrypted
          * The return instance.plaintext is the updated one
  
          Note: Will expunge the returned instance