Squid 1.9.2 Default MasterKey at-rest enforcement to Strict — an empty/weak/all-zero key now refuses to initialise the encryption service instead of silently encrypting under a recoverable key, making the at-rest encryption cluster (Account/Feed/Certificate, 1.9.1) genuinely protective. Opt-out preserved via SQUID_MASTER_KEY_ENFORCEMENT=warn|off.