Yes the default API is to self-encrypt all data. The metadata (mutable and append-able) is not self-encrypted though. What we can do there is limit the capability (to arrays) and also use the unpublishable for MD as it mutates. Append-able can be either published or not though.