The best security approach is not to let the data leave the organization if not needed.
I have not tried to decrypte the Goodlink blob, but in general data stored on the device is always subjected to hacking and decrypting- specifically if the device can read the data - it means that the private key is some where there.
You can consider another approach of securing ActiveSync using a product like ActiveSync Protector.
The Protector can add content rulles controlling data leaving the network to the device (by Exchange types, AD membership and more) + offers access control options to verify that user and phone match.
This solution is server side so it supports all devices and not only corporate standard .