If I am reading this right, the API supports creating encrypted-only peers, they can hold your data without knowing the decryption key. My interest has just been piqued.
Testing this out, looks like generating secret key through API generates three keys, encrypted, readonly, and readwrite, and I can see when I plug in an encrypted key to one node, I can see encrypted blobs are being populated from other nodes of all types, including other "encrypted" node.