add some extra layers of validation to make sure that people don't trip over magical encrypt_boot settings later in the build