always_encrypt = true