[client] make legacy encryption mode and HMAC usage mutually exclusive