Add options (enabled by default) to force HMAC encryption