allow default_encrypted == false