In the standardconfig messages are stored in cleartext at the database. If I would like to encrypt the messages, I have to use data-at-rest-encryption. (very new to me!)
So, as far as I understood it, you can ony encrypt all DBs with this.
There is no easier way to activate this via mattermost itself. e.g. “Activate DB encryption for messages”.