It's worth pointing out maybe within docs or in the output during execution that as part of the re-encryption with a different key there is no distinction between a password and other types of secrets. I.e. an environment might contain an encrypted ssh key, which would be converted to an encrypted random password on the other end.