further work on embedded encrypted config