While looking at the readme again, i've realized that my current setup just doesn't need any kind of authentication. Looking again at the readme I think, that the provided docker command also has authentication disabled (it uses --authentication-keys-directory but not --authentication=true - i've copied the relevant args from the docker command and felt safe due to the --authentication-keys-directory).

Ways to fix it:

1. Leave authentication disabled by default but enable it when --authentication-keys-directory or --authentication-password is used

• doesn't break anything
• may create problems, when users rely on default pubkey directory

2. Remove the --authentication flag and don't use default values for pubkey directory or password. If the user want's authentication he has to explicitly specify the directory or the password.

• only breaks slightly (as the --authentication flag is now unknown and will throw an error)
• One flag less to worry about
• Users using the default pubkey directory are still insecure after upgrading (if they assumed that authentication was enabled by default or when they place keys in the directory)

3. Enable authentication by default and (maybe) replace the --authentication flag by --disable-authentication to be more explicit.

• breaks all unauthenticated setups (and all others when also changing the flag)
• User has to explicitly make it insecure/public

Option 3 is the safest option, but I wouldn't mind using option 2 to keep some backwards compability