pub fn plaintext_allowed() -> bool
True if plaintext opt-out is active (CLI flag first, then deprecated env).