This instance has never had an encryption key set. The startup log confirms
it: "No encryption key is configured. Credentials will be stored in plain
text." We have a couple of feed connectors whose credentials are therefore
stored unencrypted, and we'd like to fix that.

The documentation I can find only covers preserving an existing key across a
migration (Backing Up & Restoring, Migrate to a New Server), and the
configuration files reference just notes that EncryptionKey is optional. I
can't find anything on introducing a key to an instance that doesn't have
one.

My questions:

1. Is it supported to add an EncryptionKey to an existing instance that has
   never had one?

2. What happens to credentials already stored in plaintext? Are they
   migrated/re-encrypted on startup, left as-is, or will reads fail once a
   key is configured?

3. If there's no automatic migration, is re-entering each credential through
   the UI after setting the key the correct approach?

4. We're also migrating this instance from SQL Server to PostgreSQL 17
   shortly. Is there a preferred order - set the key before or after the
   database migration, or does it not matter?

Thanks!