Thanks!
It looks like the System Console allows you to regenerate the AtRestEncryptKey with a mysterious "if you do this then some DB columns will return empty" warning message. Should the feature be disable entirely until it's working? And/or the warning message made more clear about what exactly the impact will be?