move/copy: always reencrypt passwords at destination