Master feeds corrupt binary log events to slave if it does not have the key to decrypt the binlog

• start server with binlog encryption and file_key_management plugin/keyfile;
• create some events;
• restart server with a different keyfile (different value for key 1);
• configure replication from this server as a master to a slave;
• start slave IO thread
  => it reads all events from master without visible errors;
• start slave SQL thread
  => it produces

  Last_SQL_Errno: 1594

  Last_SQL_Error: Relay log read failure: Could not parse relay log event entry. The possible reasons are: the master's binary log is corrupted (you can check this by running 'mysqlbinlog' on the binary log), the slave's relay log is corrupted (you can check this by running 'mysqlbinlog' on the relay log), a network problem, or a bug in the master's or slave's MySQL code. If you want to check the master's binary log or slave's relay log, you will be able to know their names by issuing 'SHOW SLAVE STATUS' on this slave.

I don't think it's specified anywhere how it's supposed to work; logically, I would expect that master would refuse to feed the logs which it cannot decrypt, or that IO thread would produce an error getting the rubbish from the master. However, only SQL thread notices that something is wrong.

If it's by design, please feel free to close as not a bug.