Adding an encryption key to an existing ProGet instance that never had one

[carl.westman_8110]

We're running ProGet 25.0.25 in Docker (Azure App Service for Containers,
configured via environment variables, so no shared config file).

This instance has never had an encryption key set. The startup log confirms
it: "No encryption key is configured. Credentials will be stored in plain
text." We have a couple of feed connectors whose credentials are therefore
stored unencrypted, and we'd like to fix that.

The documentation I can find only covers preserving an existing key across a
migration (Backing Up & Restoring, Migrate to a New Server), and the
configuration files reference just notes that EncryptionKey is optional. I
can't find anything on introducing a key to an instance that doesn't have
one.

My questions:

1. Is it supported to add an EncryptionKey to an existing instance that has
   never had one?

2. What happens to credentials already stored in plaintext? Are they
   migrated/re-encrypted on startup, left as-is, or will reads fail once a
   key is configured?

3. If there's no automatic migration, is re-entering each credential through
   the UI after setting the key the correct approach?

4. We're also migrating this instance from SQL Server to PostgreSQL 17
   shortly. Is there a preferred order - set the key before or after the
   database migration, or does it not matter?

Thanks!