I think this is working fine now. I do have one current irritation, but understand that it is resolved by getting all the clients updated. (Just waiting on NixOS to update its version).

Basically, I enabled encryption, synced devices one at a time. I think my iOS client is a newer version than desktop, so I have a warning about the couple new entries that can't be decrypted (yet) on desktop.

I know I could go and figure out the update for my local install, but can wait a bit for the moment.