I can see that one as a default for non-nefarious reasons. If you make it easy for non-specialist users to encrypt their machine, and there is no way for techni

I can see that one as a default for non-nefarious reasons. If you make it easy for non-specialist users to encrypt their machine, and there is no way for technical support to recover their data, you're going to inevitably end up with angry users. What's not as clear to me is whether you can change the default.