Existing vSAN clusters are configured for Data At Rest Encryption. Considering the scenario, which statement is true?

As part of a security strategy for data, a company has elected to migrate to a new KMS system.

Existing vSAN clusters are configured for Data At Rest Encryption. Considering the scenario, which statement is true?
A . Full data evacuation will be required to use the new KMS system.
B . Existing unencrypted datastores can be encrypted without data migration.
C . Existing encrypted vSAN Clusters will need to be decrypted to use the new KMS system.
D . Keys from the new KMS system can be applied without any data movement.

Answer: C