Merge "Make ServiceWatcher encryption-aware." into nyc-dev