reencryption: only reencrypt files when required