Why drop the mention that the key need also be set in portlets decrypting the password?  Seems like a helpful reminder to folks configuring this?