anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -You must configure Diego Release with a set of encryption keys to encrypt the BBS data store. The BBS Data Store encrypts all stored data.
  +You must configure Diego Release with a set of encryption keys to encrypt data in the BBS data store. The BBS Data Store encrypts all stored data.
   
   Diego automatically encrypts or re-encrypts all of the stored data using the active key upon boot. This ensures an operator can rotate out a key without manually rewriting all of the records.
   
  +## <a id="configuring-keys"></a> Configuring Encryption Keys
  +
   Diego uses multiple keys for decryption while allowing only one for encryption.
  -
  -## <a id="configuring-keys"></a> Configuring Encryption Keys
   
   To configure encryption, set the `diego.bbs.encryption_keys` and `diego.bbs.active_key_label` properties.
   
  -For example:
  +Replace the placeholders in the manifest below with values appropriate for your deployment.
  +
  +```yaml
  +properties:
  +  diego:
  +    bbs:
  +      active_key_label: KEY-LABEL-NAME
  +      encryption_keys:
  +      - label: 'KEY-LABEL-NAME'
  +        passphrase: 'MY-PASSPHRASE'
  +```
  +
  +In the example below, the operator configures two encryption keys and selects one of them to be the active key. The active key is used for encryption while all configured keys are used for decryption.
   
   ```yaml
   properties:
  
positive.code: 
  ## <a id="rotating-keys"></a> Rotating Encryption Keys
  
  An operator can rotate encryption keys without downtime, following a two-deploy procedure.
  All the records are re-encrypted with the new active key, using the old key for decryption only.
  Once that is successful, the old key is removed.
  
  For example, if rotating from `key-2017-09` to `key-2017-10`:
  
  Given the following starting manifest,
  
  ```yaml
  properties:
    diego:
      bbs:
        active_key_label: key-2017-09
        encryption_keys:
        - label: 'key-2017-09'
          passphrase: 'my september passphrase'
  ```
  
  add the new encryption key `key-2017-10`, set it as the active key and redeploy.
  
  ```yaml
  properties:
    diego:
      bbs:
        active_key_label: key-2017-10
        encryption_keys:
        - label: 'key-2017-09'
          passphrase: 'my september passphrase'
        - label: 'key-2017-10'
          passphrase: 'my october passphrase'
  ```
  Once the first deploy is successful, update the manifest to remove the old key `key-2017-09` and redeploy.
  
  ```yaml
  properties:
    diego:
      bbs:
        active_key_label: key-2017-10
        encryption_keys:
        - label: 'key-2017-10'
          passphrase: 'my october passphrase'
  ```
  After both deploys, the encryption keys will be rotated.
  The second deploy is necessary to remove the old key, otherwise the old key can still be used to decrypt information from the BBS data store.
  
negative.code:         passphrase: 'my august passphrase'
  ```
  
  ### Key Label Restrictions
  
  Key labels have the following restrictions:
  
  