Great job Heiko!
This is a very impressive piece of knowledge, thanks for sharing it with the community.
One side note thought. This part is not yet properly documented, as we all know, because R80.30 is not yet in GA.
For that matter, I urge some caution when using commands related to ccp encryption. Especially, I would not recommend setting up your own custom encryption key at all. For each cluster, a unique key is generated automatically, and tampering with this setting might lead to unpredicted cluster behaviour.