We've had some discussions with the cryptsetup maintainers, and it seems like we should be able to support online operations for encrypt, decrypt and reencrypt in version 2 of the metadata. Only reencrypt is not feasible for version 1 of the metadata because decrypt and encrypt would require shifting the data to either make room for the crypt metadata in the encrypt case or to bring the Stratis metadata to the beginning of the device in the case of decrypt. As a result, reencrypt may be supported in version 1, but all three will be support in version 2.