Read about encryption on git-annex wiki for details. MAC algorithm defaults to SHA-1, which is insecure: make sure to pass mac=HMACSHA512 when initializing a new remote.