I don't like compile time options. I forget which Bell Labs guy called this "entering run-time parameters via the compiler." I especially don't like them if there is an equivalent run-time option that works just as well. I do, however, prefer to encrypt as default. I do this by adding a command to the afs rc script. I would be open to the idea of changing the default.