> which is turned off by default.
Defaults matter.
- Most non-technical users won't know of this setting, and thus be unprotected.
- The consequence of forgetting to enable this setting is severe (forget it even once, and you risk leaking a secret for eavesdroppers).
- When security is optional, having security enabled is suspicious. When everyone has security enabled all the time, an attacker can't know whether someone is sending secrets or cat pictures.
This is why we're currently seeing a push towards encrypted by default everywhere. Not because everything needs encryption, but because then there's no risk of forgetting.