We hacked SSL encryption into wsrep_sst_xtrabackup due to its lack of encryption natively. After upgrading today, we've noticed support for xbstream. However our cluster (after upgrading) doesn't use xbstream automatically hence we're back where we started: unencrypted IST/SST traffic. On a WAN cluster that's not a good thing. Anybody can point me in the right direction on how to force Percona to use xbstream (more important, encryption) instead of tar?