services/crypto.go keeps its function names and its KEY_ENCRYPTION_KEY lookup and delegates the cipher, so vantagectl's verify probe can decrypt with the same implementation rather than a second copy.
