Encrypted env vars are not set

This is probably connected to

I suggested them to update keys on demand which would require no changes and minimal effort. But perhaps they decided to build some backward-compatible scheme instead…