This was implemented some time ago in #6650 to fix #6613 but does not appear ever to have been enabled under any circumstances outside of test/.
On a recent fresh install I'm seeing a null encryption key, and I don't see anywhere a CDBWrapper is ever created with a non-default obfuscate parameter (the default is false).