It would be nice if it was the other way around - encrypted by default and unencrypted using settings