Encrypting sections of web.config

I have successfully used aspnet_regiis.exe to encrypt and decrypt my connectionStrings section of my web.config file from a command prompt.   Lately I am working with machineKey section and generating my own keys.  I am curious if it is good practice to encrypt the machineKey section of the web.config file.  Apparently, aspnet_regiis.exe will not recognize the machineKey section or the system.web section.  I'm thinking this may be a catch 22 type situation where you can't encrypt the key being used to decrypt the sections of the web.config.  If that is the case it seems to me to be a security hole.  If someone successfully makes a file access attack on my production machine and steals my web.config file.  They can use the keys in the machineKey section to decrypt view state data and hijack an http session.  Or simply use the keys to decrypt my connectionStrings section and gain access to valuable information.  I hav ...