doc: clarify setcrypt defaults