The encryption key added in #2424 should optionally be able to have a passphrase, so it can't be used without manual intervention. Although this would mean a manual step to start the Foreman app, this may be preferable in some environments.