Handle edge cases in encryption

**Feature request**
It would be great to have filtering for validation.

**Use case**
Many users need this functionality for production deployments.

**Implementation idea**
Add a new config option `enable_filtering` with default `false`.

No files or tests are named. Start by locating the validation and configuration entry points, then trace how configuration defaults are handled. Done means the new enable_filtering option defaults to false and filtering behavior for validation edge cases is covered and verified.

Written by the indexing model from the issue text.