* Add tests asserting current behavior of our dataprotection initialization * Make unprotect keys configurable * Update Step 3 to being required * Attempt to make tests work in CI