fix migration to new encryption