[NC 20+] Legacy encryption - mitigation and documentation thereof

With Nextcloud 20, the term "Legacy encryption" was introduced. The documentation does say little about what legacy encryption is: https://docs.nextcloud.com/server/20/admin_manual/configuration_files/encryption_migration.html
I found another document, which gives hints about what could be meant: https://eprint.iacr.org/2020/1439.pdf

I run the command
occ encryption:scan:legacy-format
with output similar to this:
sudo -u www-data php /var/www/nextcloud/occ encryption:scan:legacy-format Scanning all files for legacy encryption Scanning all files for username /username/files_trashbin/files/file1.odt.d1592989576 does not have a proper header /username/files_trashbin/versions/folder1/file2.xls.v1585723230 does not have a proper header /username/files_versions/folder2/file3.xls.v1189677150 does not have a proper header

Now I got some files with inproper headers. Does my nextcloud still use legacy encryption for all files or does it use a more secure encryption? What are the differences?

When running occ encryption I also encountered a new command:
Command "encryption" is not defined.
Did you mean one of these?
encryption:change-key-storage-root
encryption:decrypt-all
encryption:disable
encryption:disable-master-key
encryption:enable
encryption:enable-master-key
encryption:encrypt-all
encryption:list-modules
encryption:migrate-key-storage-format
encryption:recover-user
encryption:scan:legacy-format
encryption:set-default-module
encryption:show-key-storage-root
encryption:status

There is no documentation about encryption:migrate-key-storage-format but an excerpt from the file /nextcloud/core/Command/Encryption/MigrateKeyStorage.php - https://fossies.org/linux/nextcloud/core/Command/Encryption/MigrateKeyStorage.php
75 ->setName('encryption:migrate-key-storage-format') 76 ->setDescription('Migrate the format of the keystorage to a newer format')

Am I supposed to use this command? I have key-type: user keys ( https://docs.nextcloud.com/server/20/admin_manual/configuration_files/encryption_details.html#key-type-user-key )
Will I still be able to use user keys after running this command, and is it save to run it?

My feature request is: please answer this questions and update the documentation of nextcloud.
Thank you very much for maintaining nextcloud! :)

Review the encryption migration and encryption details documentation, the encryption:scan:legacy-format and encryption:migrate-key-storage-format commands, and core/Command/Encryption/MigrateKeyStorage.php. Determine the documented answers about legacy encryption, improper headers, migration safety, and user keys, then update the relevant documentation with supported guidance.