First experiment if it can be set directly on the context. Otherwise it might have to be set in the smb.conf file.

Would include adding a policy for "shares must be encrypted".

Ideally this could also be a per share option (verify current behavior) that could be selected at mount time, but if that is not possible. Initially we can make it apply to all shares.