Merge "CDD: AES encrypt the encryption key by default" into oc-mr1-dev