hiding encrypt/decrypt password

hi,

my customer wants to use a fixed password for the pgcrypto pgp_sym_encrypt/decrypt functions.
The pgp function calls will be isolated to a custom function for decrypt and 3 encrypt functions (text, date, timestamp signatures).
there is a separate function to return is a user is authorized to decrypt so don't worry about that part.

all registered users (not public) will be able to execute the decrypt function.

any suggestions about how to hide the password?
I've thought of

1. external function. external functions call compiled code, so you only see the function call, not the content. external functions need to be coded in 'c'. I don't have the experience to implement. couldn't users execute the function directly and get the decrypted password?

2. python function that opens an OS session. once the session is started, it can interact with the OS and use the openSSL function to decrypt the password stored in an os file. the decrypt password could be stored in a different os file. Same issue, can't users execute function and get the password?

Thanks in advance for your thoughts?
Doug Little