> I note that the MS Crypto API has the ability to perform two types of encryption using a key -- session block or session stream.

Actually, the Crypto API has all kinds of encryption you can use, including public key encryption like your client wants to use. If you look in the Solution Samples included with VFP 8, theres an example under the Foundation Classes (Adding encryption to apps). On the Signing Files tab is an example that's pretty close to what you want.