Encryption storage wrapper is enabled by default - necessary to detect encrypted files even if encryption was disabled after files have been encrypted - prevents data corruption

in case the file exists we require the explicit module as specified in the file header - otherwise we need to fail hard to prevent data loss on client side