You're right -- it needs to be enabled manually using `--opt encrypted`. 1.13 is shooting for this to be the default.