@witlessbird, Yes, I think it's better not to have the encryption key in settings.yaml
I will work on creating a rake task to generate a constant in the module Encryptable