better descriptions for encryption config